In yesterday’s installment of the Elizabeth Holmes criminal trial, the jury heard some eye-opening testimony from Sunil Dhawan, the doctor Theranos hired to replace its previous lab director.

Dhawan was the longtime dermatologist of Theranos COO Ramesh “Sunny” Balwani, who will be facing the same fraud charges as Holmes in the spring. Dhawan was a board-certified doctor, so he met state and federal requirements to be a lab director.

But unlike Adam Rosendorff, the previous director who resigned over the questionable accuracy of the company’s test results, Dhawan was not board certified in laboratory science, nor did he have any prior experience running a lab of that scale or scope. Dhawan also admitted that he had to google Theranos’ tech when Balwani initially approached him—before he was recruited, he hadn’t known much about the company’s technology.

But after some googling and “one short conversation about it,” Dhawan agreed to serve as Theranos’ lab director so long as it didn’t interfere with his day job as a dermatologist or his family life. “The time commitment is very minimal,” Balwani assured him.

And it was. Dhawan testified that he went to Theranos twice and that he worked a total of five to ten hours between November 2014 and June 2015. In that time, he basically signed whatever Balwani sent him. Theranos agreed to pay him $5,000 per month, though he says he never cashed any checks and once asked to be paid in stock options instead.

State inspection

Things ramped up a bit in September 2015, when he had to go to Theranos’ headquarters to sign 300 standard operating procedures in person. “Rosendorff’s signature provided comfort to me—gave me some reassurance there had been some supervision before my arrival,” Dhawan said. Also in September 2015, Dhawan was present for a state inspection of the lab.

Before the lab inspection, Dhawan hadn’t spoken with anyone who worked in the lab. “There wasn’t one time you spoke to a Theranos employee who worked in the lab?” assistant US attorney Jeff Schenk asked him.

“I don’t recall any conversation in that length of time,” Dhawan said. He also said he didn’t meet with any other employees, doctors, or patients. He didn’t meet Holmes until September 2015.

After the lab inspection, Dhawan said the work dwindled, and no one at Theranos told him when he was relieved from his post.

Under cross-examination by Holmes’ attorney Lance Wade, Dhawan said that he assumed Balwani was “a top executive.” 

“He was running the laboratory from an operational standpoint, correct?” Wade asked.

“I can’t comment on that because I was never told he was running the lab,” Dhawan said, “but it was my assumption he was, yeah.”

More details on Walgreens deal

Before Dhawan’s testimony began, the jury heard from Nimesh Jhaveri, a former Walgreens executive, who described the prospect of a finger-prick blood test as “extraordinary.” Veinous draws require phlebotomists. “Less blood required was the actual magic, it was so intriguing to us at Walgreens,” he said.

His company announced in September 2013 that it had invested $140 million in Theranos, but already in early 2014, problems were emerging. Theranos was still drawing veinous blood around 40 percent of the time, far higher than Jhaveri wanted. Ultimately, he wanted to drive the percentage to zero, he said. Balwani told him that they’d get below 5 percent by the end of the year, a target Theranos never reached.

Walgreens had rolled out the startup’s technology in 40 drugstores in Arizona and one in California, but Theranos’ testing wasn’t living up to its promise. “We need to have a documented detailed plan on both or it will be difficult for me to convince expansion beyond AZ,” Jhaveri wrote to Balwani. Walgreens had plans to expand it to 500 stores in fiscal year 2015, a target they scaled back to 200.

“Cost was an obstacle, training our team members was an obstacle, hiring phlebotomists was an obstacle,” Jhaveri told the court. “The entire operating model was not perfected, so that’s why we decided to reduce the number.” Ultimately, Walgreens never expanded beyond the initial rollout of 40 stores in Arizona and one store in California.

Holmes’ attorney Kevin Downey attempted to distance his client from the matter in cross-examination, asking Jhaveri how many times he met with Holmes. “Maybe two or three times at most,” he replied.

Jhaveri told the prosecution that once news articles began to break in 2015 about Theranos, its technology, and its finances, the relationship between the two companies began to unravel slowly at first, then quickly. In January 2016, Walgreens stopped offering Theranos’ tests at one store, and by June, they were all “turned off,” Jhaveri said. In November, Walgreens sued the startup for $125 million.

https://arstechnica.com/?p=1804451

Missouri Gov. Mike Parson today threatened to prosecute and seek civil damages from a St. Louis Post-Dispatch journalist who identified a security flaw that exposed the Social Security numbers of teachers and other school employees, claiming that the journalist is a “hacker” and that the newspaper’s reporting was nothing more than a “political vendetta” and “an attempt to embarrass the state and sell headlines for their news outlet.” The Republican governor also vowed to hold the Post-Dispatch “accountable” for the supposed crime of helping the state find and fix a security vulnerability that could have harmed teachers.

Despite Parson’s surprising description of a security report that normally wouldn’t be particularly controversial, it appears that the Post-Dispatch handled the problem in a way that prevented harm to school employees while encouraging the state to close what one security professor called a “mind-boggling” vulnerability. Josh Renaud, a Post-Dispatch web developer who also writes articles, wrote in a report published yesterday that more than 100,000 Social Security numbers were vulnerable “in a web application that allowed the public to search teacher certifications and credentials.” The Social Security numbers of school administrators and counselors were also vulnerable.

“Though no private information was clearly visible nor searchable on any of the web pages, the newspaper found that teachers’ Social Security numbers were contained in the HTML source code of the pages involved,” the report said.

The Post-Dispatch seems to have done exactly what ethical security researchers generally do in these situations: give the organization with the vulnerability time to close the hole before making it public.

“The newspaper delayed publishing this report to give the department time to take steps to protect teachers’ private information and to allow the state to ensure no other agencies’ web applications contained similar vulnerabilities,” the article said. The news report was published one day after the “department removed the affected pages from its website.”

As of this writing, the DESE’s educator-credentials checker was “down for maintenance.”

Governor: Journalist tried to “harm Missourians”

Parson described the journalist as a “perpetrator” who “took the records of at least three educators, decoded the HTML source code, and viewed the Social Security number of those specific educators” in an “attempt to steal personal information and harm Missourians.”

Major web browsers include options such as “view source” or “view page source” to look at a webpage’s HTML, so anything in that code is easily available. The initial Post-Dispatch article didn’t go into detail about how the Social Security numbers were obtained from HTML source code, but a follow-up article about Parson’s legal threats today said that the “teachers’ Social Security numbers were present in the publicly visible HTML source code of the pages involved.” The numbers weren’t available in plain text but were easily converted, the Post-Dispatch continued:

The data on DESE’s website was encoded but not encrypted, said Shaji Khan, a cybersecurity professor at the University of Missouri-St. Louis—and that’s a key distinction. No one can view encrypted data without the specific decryption key used to hide the data. But encoded just means the data is in a different format and can be relatively easily decoded and viewed.

“Anybody who knows anything about development—and the bad guys are way ahead—can easily decode that data,” Khan said on Thursday.

Governor notified prosecutor of “crime against teachers”

Parson spoke today (see video) at a “press conference regarding [the] data vulnerability and [the] state’s plan to hold perpetrators accountable,” and he posted a condensed version of his remarks on Facebook.

“It is unlawful to access encoded data and systems in order to examine other people’s personal information, and we are coordinating state resources to respond and utilize all legal methods available. My administration has notified the Cole County prosecutor of this matter. The Missouri State Highway Patrol’s Digital Forensic Unit will also be conducting an investigation of all of those involved,” he said.

Parson went on to say that state law “allows us to bring a civil suit to recover damages against all those involved.” He cited Missouri code 569.095, which classifies “tampering with computer data” as a class A misdemeanor.

Parson continued:

Nothing on DESE’s [the Department of Elementary and Secondary Education’s] website gave permission or authorization for this individual to access teacher data. This individual is not a victim. They were acting against a state agency to compromise teachers’ personal information in an attempt to embarrass the state and sell headlines for their news outlet.

We will not let this crime against Missouri teachers go unpunished, and we refuse to let them be a pawn in the news outlet’s political vendetta. Not only are we going to hold this individual accountable but we will also be holding accountable all those who aided this individual and the media corporation that employs them.

Parson further claimed that the incident “may cost Missouri taxpayers up to $50 million and divert workers and resources from other state agencies,” though that number might be inflated by Parson trying to turn a simple report of a security vulnerability into a criminal hacking case.

https://arstechnica.com/?p=1804306

Theranos founder Elizabeth Holmes gave Walgreens executives fake reports from major pharmaceutical companies to lend credibility to her company’s ill-fated blood diagnostic devices.

The bombshell came during the prosecution’s questioning of former Walgreens CFO Wade Miquelon. Holmes is on trial for 10 counts of wire fraud and two counts of conspiracy to commit wire fraud. Partly on the strength of those reports, Walgreens would go on to make a $140 million deal with Holmes’ startup $100 million as an “innovation fee,” and $40 million as convertible notes that could be converted into equity.

“Our common understanding was the technology worked as we were told,” Miquelon told jurors. He said his company had also spoken with doctors and other experts at Johns Hopkins who said Theranos’ technology was sound and would be useful in clinics like the kind Walgreens envisioned. However, Walgreens executives weren’t able to validate the device first-hand—Theranos took it back before they had the chance.

On cross-examination, Miquelon said Walgreens had hired an external lab to review Theranos’ results but not the machine itself. “They were interpreting data they were given as opposed to taking the machine apart, if you will,” he said.

“Lead pony”

Holmes was in talks with both Walgreens and Safeway in 2010. Earlier, the jury heard testimony from Safeway’s former CEO, Steven Burd, who thought Theranos’ technology “was a fascinating concept” and described Holmes as charismatic, smart, and decisive. 

Miquelon was similarly upbeat about Theranos. “This was one of the most exciting companies that we had seen, maybe not just in lab but in general,” Miquelon said. In a March 2010 email to Greg Wasson, who was Walgreens’ CEO at the time, Miquelon wrote that they “may have found the lead pony” among companies that offer diagnostic tests where patients receive care.

Holmes told Walgreens executives that three pharmaceutical companies—including Pfizer and Schering-Plough—had performed due diligence on her company’s blood-testing technology. She convinced them that vetting by those and other companies and experts was enough to move ahead with a partnership. Holmes dropped names, too, mentioning that Oracle co-founder Larry Ellison had endorsed the company’s tech, Miquelon said.

But the reports from both Pfizer and Schering-Plough were faked, prosecutors said. The report from the latter company even contained a typo—“Schering Plough Research Institure,” misspelling the word “institute”—a detail Miquelon told jurors he had missed.

Holmes also told Walgreens executives that Theranos’ proprietary Edison devices could perform nearly all conventional lab tests in just 15–20 minutes. “My understanding is [that] the blood would be tested on the Edison device,” Miquelon told the court. “My understanding was that the base-level testing would be able to do 96 percent of the testing done at labs.”

Souring relationship

Walgreens agreed to a deal in 2010, Miquelon said, with the right to terminate at the end of the year if Theranos didn’t receive approval from the Food and Drug Administration. The startup didn’t get approval, but Walgreens didn’t end things. Instead, it moved forward with “Project Beta” in 2010 and “Project Normandy” in 2012, working through specifics and hammering out regulatory questions. There was a question, for example, about whether each Walgreens lab would need to be regulated or whether Theranos’ main lab would cover all the devices. “Due to the new-to-the world nature of the technology, it required some work to understand,” Miquelon said.

In August 2013, just before Walgreens was scheduled to launch Theranos testing in 40 stores across Arizona and California, Holmes asked the drug store company to advance the startup part of the agreed-upon $100 million “innovation fee.” 

Over the next year, Walgreens’ relationship with Theranos soured. The blood-testing startup ended up voiding tens of thousands of test results after regulators began probing the company. In 2016, Walgreens sued Theranos for $140 million before ultimately settling for $25 million.

https://arstechnica.com/?p=1804181

This is the story of the mastermind behind one of the largest “fake news” operations in the US.

For two years, he ran websites and Facebook groups that spread bogus stories, conspiracy theories, and propaganda. Under him was a dedicated team of writers and editors paid to produce deceptive content—from outright hoaxes to political propaganda—with the supreme goal of tipping the 2016 election to Donald Trump.

Through extensive efforts, he built a secret network of self-reinforcing sites from the ground up. He devised a strategy that got prominent personalities—including Trump—to retweet misleading claims to their followers. And he fooled unwary American citizens, including the hacker’s own father, into regarding fake news sources more highly than the mainstream media.

Pundits and governments just might have given Russia too much credit, he says, when a whole system of manipulating people’s perception and psychology was engineered and operated from within the US.

“Russia played such a minor role that they weren’t even a blip on the radar,” the hacker told me recently. “This was normal for politicians, though… if you say a lie enough times, everyone will believe it.”

Previously dubbed “Hacker X,” he’s now ready to reveal who he is—and how he did it.

The samurai

The fake news impresario who has now decided to break his silence is “ethical hacker” Robert Willis.

Some in the information security community might know “Rob” today as an active member who speaks at conferences and works with the Sakura Samurai ethical hacking group. (The Sakura Samurai have, on many occasions, responsibly disclosed vulnerabilities in the computer systems of government and private entities. I have previously interacted with Rob on about two occasions, minimally, when I had questions regarding Sakura Samurai’s vulnerability writeups.)

But back in 2015, Willis was just another hacker looking for an IT job. He had already received one job offer—but still had an interview scheduled at one final company.

“I was thinking of not showing up to the interview,” he told me. “I had, after all, just committed to another company.”

That final company was opaque—it would not reveal either its name or the actual job duties until Willis showed up in person. But the opacity was itself intriguing. Willis decided to do the interview.

“I showed up at the location, which was a large corporate building. I was given directions to wait downstairs until I was collected. The secretiveness was intriguing. It may have turned some people off, but I love an adventure. I had not been given any information on the job other than that they were very excited, because to find someone like me was very rare—I had tons of random, overlapping, highly technical skills from years of wearing multiple hats at smaller private companies.”

Even before his ethical hacking days at Sakura Samurai, Willis had gained an extensive technical skill set in networking, web applications, hacking, security, search engine optimization (SEO), graphic design, entrepreneurship, and management. He knew how to take advantage of search engine algorithms, once, he said, getting a random phrase to the No. 1 spot on one engine within 24 hours. “Many will say this is/was impossible, but I have the receipts,” he said, “and so do other credible people.”

At the interview site, a man came down to get him, and they rode the elevator to a floor with a nearly empty office. Inside waited a woman beside three chairs. They all sat. His hosts finally revealed the name of their company: Koala Media. The moment felt like an orchestrated Big Reveal.

“I wasn’t scared but excited at how crazy this was already turning out [to be],” Willis told me. “I listened. I was told that there were big plans for the office I was sitting in and that they had already hired the initial writers and editor for the new operation.”

The interviewers at the company told Willis that “everything was to be built with security in mind—at extreme levels.”

Should he get the job, his primary role would be to rapidly expand a single, popular website already owned by Koala Media. For this, they needed someone with Willis’ diverse skill set.

Then the interview took a political turn. “They told me that they were against big companies and big government because they are basically the same thing,” Willis said. They said they had readers on the right and the left. They said they were about “freedom.” That sounded OK to Willis, who describes himself as a social liberal and fiscal conservative—”very punk rock, borderline anarchist.”

Then the interviewers told him, “If you work for us, you can help stop Hillary Clinton.”

“I hated the establishment, Republicans, and Democrats, and Hillary was the target because she was as establishment as it got and was the only candidate that was all but guaranteed to be running on the main ticket in the future 2016 cycle,” said Willis. “If I were to choose a lesser evil at the time, it would have, without a doubt, been the Republican Party, since I had moved to the new city due to the Democrats literally destroying my previous home state. It felt like good revenge.”

Willis says he had no indication that the company that was about to recruit him was extreme or would become so in the future. In his perception, the company was just “investigative” with regard to its journalism.

When Koala offered him the job, he took it.

https://arstechnica.com/?p=1802739

American Airlines and Southwest Airlines said they will not comply with the Texas governor’s ban on vaccine mandates, saying that the US vaccine mandate for federal contractors takes precedence. Both airlines are headquartered in Texas.

“We are reviewing the executive order issued by Gov. Abbott, but we believe the federal vaccine mandate supersedes any conflicting state laws, and this does not change anything for American,” an American Airlines spokesperson told The Washington Post and other news organizations. Southwest said that “according to the president’s executive order, federal action supersedes any state mandate or law, and we would be expected to comply with the president’s order to remain compliant as a federal contractor,” according to CNBC.

IBM, which is based in New York but has several large offices in Texas, will also follow the federal order instead of the one in Texas. “IBM is a federal contractor and must comply with federal requirements, which direct employees of federal contractors to be fully vaccinated against COVID-19 by December 8th or obtain a medical or religious accommodation,” IBM told Bloomberg. “We will continue to protect the health and safety of IBM employees and clients, and we will continue to follow federal requirements.”

Texas-based Dell said that “any employee or contractor who experiences challenges with the policy will have the option, by role, to work remotely,” according to Time.

Texas governor claims Biden “bullying” private entities

Texas Governor Greg Abbott on Monday issued an executive order stating that “no entity in Texas can compel receipt of a COVID-19 vaccine by any individual, including an employee or a consumer, who objects to such vaccination for any reason of personal conscience, based on a religious belief, or for medical reasons, including prior recovery from COVID-19.” The executive order applies even to private businesses and claims that the Biden administration is committing “federal overreach” by “bullying many private entities into imposing COVID-19 vaccine mandates, causing workforce disruptions that threaten Texas’ continued recovery from the COVID-19 disaster.”

“Countless Texans fear losing their livelihoods because they object to receiving a COVID-19 vaccination for reasons of personal conscience,” the order also said. Abbott’s move was a reversal from his previous stance, as his spokesperson said in August that “private businesses don’t need government running their business.”

Biden in September issued an executive order requiring adequate COVID safety protocols for federal contractors, and the Biden administration later issued guidance stating that federal contractors and subcontractors must require “COVID-19 vaccination of covered contractor employees, except in limited circumstances where an employee is legally entitled to an accommodation.”

Biden is also requiring vaccines for health care workers in US-funded facilities and vaccines or weekly tests for employees of private companies with at least 100 employees.

US Sen. Ted Cruz (R-Texas) claimed on Twitter that Southwest canceling flights is evidence of “Joe Biden’s illegal vaccine mandate at work!” However, Southwest blamed weather and air traffic control problems in addition to a staff shortage and said claims that flights were canceled because of employees protesting the company’s vaccine mandate are “inaccurate” and that “there’s a lot of unfounded rumor and speculation circulating.” The Southwest Airlines Pilots Association said its members “are not participating in any official or unofficial job actions.”

https://arstechnica.com/?p=1803888

Safeway’s ex-CEO said his company did more than 100 hours of due diligence for a deal with Theranos that would ultimately cost the grocery chain over $360 million before the agreement was axed. 

Yet, even after that research, when Safeway trialed Theranos’ diagnostic devices at its corporate headquarters for almost a year, then-CEO Steven Burd said it became clear that the startup was a mess, losing patients’ tests and returning weird results.

“I think whenever you start something new, you’re going to have some rough spots, but we continued to have rough spots,” he said. “We had samples that were lost. We had results that didn’t make any sense.”

Burd’s revelations emerged during cross-examination by Elizabeth Holmes’ defense attorney, Kevin Downey. Holmes is on trial for 10 counts of wire fraud and two counts of conspiracy to commit wire fraud.

The court also heard more from Burd about the “test” that Holmes performed when pitching Safeway’s board members. Michael Shannon, a board director, had his finger pricked and his blood assessed for prostate-specific antigen, a screening test for prostate cancer. The Theranos device “made a bunch of noise,” Burd said, but never delivered a result. Holmes, he added, “said something that made us think we would get it later.” They didn’t.

Due diligence questioned

In his cross-examination, Downey pressed Burd on the finer points of the Safeway-Theranos deal, trying to make the case that the experienced executive knew what he was getting into—he had been CEO of the grocery chain for almost two decades when he met the 26-year-old Holmes.

“You knew at the time she was a very young entrepreneur?” Downey asked him.

“Correct,” Burd replied.

“Is it fair to say in the process of doing a deal, Safeway did hundreds of hours of due diligence?” Downey asked.

“At least 100,” Burd said. 

The deal called for Safeway to pay Theranos $85 million in addition to renovating its stores to accommodate small labs for the blood-testing devices. For a deal that size, more than 100 hours is a significant amount of time spent on due diligence, according to a biotech executive Ars spoke with. The figure Burd mentioned in court was so high that the executive wondered whether Burd was counting diligence done by other investors toward Safeway’s total, which is sometimes the case at smaller companies.

As part of the diligence process, Burd said he spoke with doctors and lab directors at Johns Hopkins and the University of California, San Francisco. But the Johns Hopkins experts said they had not spent enough time with Theranos’ device to validate it.

Holmes had promised Safeway executives that her company’s diagnostic device could return results to patients in 20 to 30 minutes. Yet, when Safeway was testing the machines, it was taking three to five days for Theranos to send results back to patients.

The contract for the deal did not contain any specific timelines, though the Safeway board had been given presentations in 2010 that outlined a pilot program rollout in the first quarter of 2011 and an official launch in grocery stores in the middle of 2011. Safeway had hoped to expand testing to over 900 stores in 22 states.

Safeway did have several ways to back out of the deal. If they didn’t like the way the pilot program was proceeding or if the FDA was going to bring regulatory action against the startup, they could cancel with 30 days’ notice. Ultimately, Theranos never made it that far. By the time the deal finally dissolved in 2015, Safeway had spent over $300 million preparing its stores.

https://arstechnica.com/?p=1803770

Apple is appealing the court ruling that said the company must let iOS app developers direct customers to payment options other than Apple’s in-app purchasing system. Although Apple previously called the ruling a “resounding victory” because its App Store business model was generally upheld, the company is seeking a stay that would prevent implementation of the injunction requiring Apple to loosen its app rules.

On September 10, Judge Yvonne Gonzalez Rogers of US District Court for the Northern District of California ruled in favor of Epic Games’ claim that Apple violated California’s Unfair Competition Law. The judge issued a permanent injunction that said Apple must stop “prohibiting developers from (i) including in their apps and their metadata buttons, external links, or other calls to action that direct customers to purchasing mechanisms, in addition to In-App Purchasing and (ii) communicating with customers through points of contact obtained voluntarily from customers through account registration within the app.”

If Apple isn’t successful in blocking that injunction, the iPhone maker will have to comply with it beginning on December 9. That would make it easier for third-party app developers to collect revenue without giving Apple commissions of up to 30 percent.

Apple recently made some concessions to third-party developers, agreeing in a pending settlement to let them notify customers of other payment options using email addresses and phone numbers obtained within their apps and letting music, video, and book apps link to other purchase options beginning in early 2022. But Apple doesn’t want to allow games and other types of iOS apps to link to different payment options.

Apple claims security risks

On Friday, Apple told the District Court that it will appeal to the US Court of Appeals for the Ninth Circuit and asked the District Court for a stay of the injunction pending appeal.

Apple claimed that “precipitous implementation” of the injunction’s requirement to let developers deploy in-app “buttons, external links, or other calls to action” would “upset the careful balance between developers and customers provided by the App Store and would irreparably harm both Apple and consumers. The requested stay will allow Apple to protect consumers and safeguard its platform while the company works through the complex and rapidly evolving legal, technological, and economic issues that any revisions to this guideline would implicate.”

Apple argued that the injunction will create security risks for users:

Links and buttons to alternate payment mechanisms are fraught with risk. Users who click on a payment link embedded in an app—particularly one distributed through the curated App Store—will expect to be led to a webpage where they can securely provide their payment information, email address, or other personal information. A developer may thus try to take advantage of user trust, carefully cultivated by Apple’s safe and secure platform, and deceive users into providing their payment information to a malicious platform. And while developers are required to disclose their handling of users’ privacy information within the app, there is no way for Apple to confirm that a developer’s payment page will adhere to those representations.

Moreover, because external links operate outside of iOS—and outside of Apple’s commerce engine—Apple has no visibility into their technological and financial functions, and limited ability to redress fraud by identifying and removing bad actors from the App Store.

Apple claimed that “implementation of the injunction would require substantial technical and engineering changes,” including “technical solutions to address the security and privacy vulnerabilities” and new app-review processes and guidelines. Apple also argued that “the injunction is overbroad in that it extends beyond Epic and affects all developers in the United States.”

Apple’s incomplete victory

Last month, Apple described the ruling as a “resounding victory,” saying that “Apple’s App Store business model has been validated” because the court “ruled that this framework is lawful and Apple was justified in terminating Epic’s status as a developer on the App Store.” Despite issuing the permanent injunction against Apple, the judge also ruled in favor of Apple’s counterclaim for breach of contract and ordered Epic to pay Apple damages “equal to 30 percent of the $12,167,719 in revenue Epic Games collected from users in the Fortnite app on iOS through Epic Direct Payment between August and October 2020” and 30 percent of revenue after November 1, 2020. Epic notified the court on September 12 that it would appeal to the US Court of Appeals for the Ninth Circuit.

Apple said it is also seeking a stay of the injunction from the Ninth Circuit federal appeals court. “If the [District] Court determines that a stay pending appeal is inappropriate, Apple requests that the court temporarily stay enforcement of the injunction while Apple seeks a stay from the Ninth Circuit,” the motion said.

Judge Gonzalez Rogers found that Apple is not “an antitrust monopolist in the submarket for mobile gaming transactions” but ruled that “Apple’s conduct in enforcing anti-steering restrictions is anticompetitive.” She called the permanent injunction a “measured remedy [that] will increase competition, increase transparency, [and] increase consumer choice and information while preserving Apple’s iOS ecosystem, which has procompetitive justifications.”

While the judge found that Apple violated California law, Apple pointed out in its motion for a stay that “Epic failed to prove that Apple violated any federal or state antitrust law.” Apple claimed that it is likely to succeed on appeal because “Epic’s theory of liability under the UCL [Unfair Competition Law] cannot be reconciled with the findings and conclusions the court made elsewhere in its opinion, particularly in recognizing the procompetitive justifications for Apple’s IAP [in-app purchasing] requirement. Indeed, the Supreme Court has recognized the procompetitive effects of anti-steering provisions in particular, as they fulfill the ‘promise of a frictionless transaction.’ The undisputed evidence in this case established that operators of two-sided transaction platforms, like the App Store, commonly impose some kind of steering restrictions on platform participants.”

https://arstechnica.com/?p=1803108

Microsoft’s Xbox and Surface hardware may be getting easier to repair, according to a press release from shareholder advocacy nonprofit As You Sow. According to the announcement, Microsoft has agreed to evaluate and expand the repair options for its products “by the end of 2022.” Specifically, the company has agreed to:

• Complete a third-party study evaluating the environmental and social impacts associated with increasing consumer access to repair and determine new mechanisms to increase access to repair, including for Surface devices and Xbox consoles
• Expand the availability of certain parts and repair documentation beyond Microsoft’s Authorized Service Provider network
• Initiate new mechanisms to enable and facilitate local repair options for consumers

These are all pretty vague guarantees, and they don’t mean that your next Xbox or Surface tablet will suddenly become fully user-serviceable. But the commitments do at least suggest that, long-term, it will be easier to get parts for these devices when they break, and it will be easier to find a shop that can make the repairs without needing to go directly to Microsoft. According to a report from Grist, a summary of the third-party study will be shared with the public by May of 2022.

Microsoft made the commitments in response to a June 2021 shareholder resolution from As You Sow, a nonprofit that “promote[s] environmental and social corporate responsibility through shareholder advocacy, coalition building, and innovative legal strategies.” We normally hear about “right to repair” in the context of state and federal legislation or executive orders, but those efforts have moved slowly in the face of legislative gridlock and industry opposition. Shareholder-driven initiatives like this one are a more direct, albeit piecemeal, way to address the problem in the meantime.

Microsoft’s hardware division has taken baby steps in the direction of making its products easier to repair in their most recent iterations, including Surface Laptops with fully accessible innards and replaceable SSDs on some Surface Pro models. But those changes only look like improvements because Microsoft did so poorly on this front for so many years; as documented by teardown sites like iFixit, multiple generations of Surface Pro are nearly impossible to open without destroying. And as we detailed in our Surface Pro 8 review, it’s difficult to find SSDs that are physically small enough to fit inside the tablet’s replaceable SSD slot.

https://arstechnica.com/?p=1802551

Late Thursday, Google announced that it is demonetizing content that makes misleading or false claims about climate change. As a result, content that calls into question or denies the scientific consensus around anthropogenic climate change will not have Google advertising alongside it. In addition, Google will no longer run any advertising that “contradicts well-established scientific consensus around the existence and causes of climate change.”

With a worldwide public-health crisis taking place in the midst of natural disasters that are fueled, at least in part, by human-caused climate change, the amount of misinformation and outright falsehoods is not only frustrating but dangerous. Google has been criticized for its role in the spread of misinformation, and many people are unhappy with the company. People paying for ads don’t want their ads appearing alongside misinformation-filled videos, and content producers don’t want to see their product interrupted by error-filled ads.

Message received, says Google.

“We’ve heard directly from a growing number of our advertising and publisher partners who have expressed concerns about ads that run alongside or promote inaccurate claims about climate change,” Google said. “Advertisers simply don’t want their ads to appear next to this content. And publishers and creators don’t want ads promoting these claims to appear on their pages or videos.”

Google will be using its usual combo of human eyes and automated tools for enforcement once the policy goes into effect in November.

https://arstechnica.com/?p=1802496

Cloudflare is not liable for the copyright infringement of websites that use its content-delivery and security services, a federal judge ruled yesterday.

Cloudflare was sued in November 2018 by Mon Cheri Bridals and Maggie Sottero Designs, two wedding dress manufacturers and sellers that alleged Cloudflare was guilty of contributory copyright infringement because it didn’t terminate services for websites that infringed on the dressmakers’ copyrighted designs. The companies sought a jury trial, but Judge Vince Chhabria yesterday granted Cloudflare’s motion for summary judgment in a ruling in US District Court for the Northern District of California.

Chhabria noted that the dressmakers have been harmed “by the proliferation of counterfeit retailers that sell knock-off dresses using the plaintiffs’ copyrighted images” and that they have “gone after the infringers in a range of actions, but to no avail—every time a website is successfully shut down, a new one takes its place.” Chhabria continued:

In an effort to more effectively stamp out infringement, the plaintiffs now go after a service common to many of the infringers: Cloudflare. The plaintiffs claim that Cloudflare contributes to the underlying copyright infringement by providing infringers with caching, content delivery, and security services. Because a reasonable jury could not—at least on this record—conclude that Cloudflare materially contributes to the underlying copyright infringement, the plaintiffs’ motion for summary judgment is denied and Cloudflare’s motion for summary judgment is granted.

While the ruling resolves the lawsuit’s central question in Cloudflare’s favor, the judge scheduled a case management conference for October 27 “to discuss what’s left of the case.”

Hundreds of counterfeiting websites

The companies’ lawsuit said they “are two of the largest manufacturers and wholesalers of wedding dresses and social occasion wear in the United States” and “have developed many of the world’s most unique and original wedding and social occasion dress patterns.” They own the copyrights for those designs and for photographic images of the designs.

Most of the websites selling counterfeit versions of the dresses operate from China, the lawsuit said. In addition to Cloudflare, an amended complaint listed 500 “Doe” defendants whose real names were unknown. The lawsuit said the Cloudflare terms say that any violation of law justifies termination of service and that “CloudFlare’s policy is to investigate violations of these terms of service and terminate repeat infringers.”

The plaintiffs said they used a vendor called Counterfeit Technology to find over 365 infringing websites that are users of Cloudflare, including cabridals.com, bidbel.com, stydress.com, angelemall.co.nz, jollyfeel.com, russjoan.com, missydress.com.au, and livedressy.com. The plaintiffs said they sent Cloudflare thousands of takedown notices, and often up to four notices about the same infringing sites, but “Cloudflare has ignored these notices and takes no action after being notified of infringing content on its clients’ websites.

“Specifically, even after learning of specific, identified acts of copyright infringement by the infringing websites through plaintiffs’ takedown notices, Cloudflare continues to cache, mirror, and store a copy of the infringing websites and the infringing content on its data center servers, and to transmit upon request copies of the infringing content to visitors of the infringing websites,” the amended complaint said. “Cloudflare’s contributions allow the Internet browsers of visitors to the infringing websites to access and load the infringing websites and content much faster than if the user was forced to access the infringing websites and content from the primary host absent Cloudflare’s services.”

The plaintiffs argued that Cloudflare should have terminated caching services to these websites, blocked traffic traveling through Cloudflare’s network to the websites, “and reconfigur[ed] its firewall settings so that users trying to access the infringing domain would be redirected to a blank page.”

Cloudflare: “Lawsuit based on a fundamental misunderstanding”

Cloudflare argued that the plaintiffs “brought this lawsuit based on a fundamental misunderstanding of Cloudflare’s services, the contributory copyright infringement doctrine, and the Digital Millennium Copyright Act, all in pursuit of a statutory damages windfall that has nothing to do with the harm they claim to have suffered.” A victory for the plaintiffs would amount to “an expansion of the contributory infringement doctrine far beyond its established limits,” Cloudflare told the court.

Cloudflare continued:

Cloudflare is nothing like the search engines and peer-to-peer networks that the [US Court of Appeals for the] Ninth Circuit has found “significantly magnify otherwise immaterial infringements.” Whereas Cloudflare’s services protect against malicious attacks and at most confer a split-second advantage to the loading time of a website someone is already visiting, the services previously considered by the Ninth Circuit actually helped visitors find infringing material they otherwise never would have found. There also is no ‘simple measure’ that Cloudflare failed to take to prevent further infringements in this case. Unlike hosting providers, Cloudflare could not remove allegedly infringing material from the Internet, and there is no question that those images would have remained available and equally accessible on the accused websites without Cloudflare’s services.

Cloudflare offers a mix of free and paid services.

Judge explains why Cloudflare isn’t liable

A defendant is liable for contributory copyright infringement if it has knowledge of another’s infringement and materially contributes to or induces that infringement, the judge noted in his ruling against the dressmakers. “Simply providing services to a copyright infringer does not qualify as a ‘material contribution,'” he wrote. “Rather, liability in the Internet context follows where a party ‘facilitate[s] access’ to infringing websites in such a way that ‘significantly magnif[ies]’ the underlying infringement.”

Although a defendant can be found to materially contribute to copyright infringement if it acts as “an essential step in the infringement process,” this should not be interpreted too broadly, the judge wrote.

“As the Ninth Circuit has recognized, the language used in these tests is ‘quite broad’ and could encompass much innocuous activity if considered out of context. An analysis of contributory copyright infringement must therefore be cognizant of the facts in the key cases in which liability has been found,” Chhabria wrote.

Mon Cheri Bridals and Maggie Sottero Designs alleged that Cloudflare contributes to copyright infringement by providing performance-improvement services, including its content-distribution network and caching capabilities that improve the quality of webpages and make them load faster, Chhabria wrote. But the “plaintiffs have not presented evidence from which a jury could conclude that Cloudflare’s performance-improvement services materially contribute to copyright infringement. The plaintiffs’ only evidence of the effects of these services is promotional material from Cloudflare’s website touting the benefits of its services. These general statements do not speak to the effects of Cloudflare on the direct infringement at issue here.”

The plaintiffs did not prove that the faster website-load times enabled by Cloudflare “would be likely to lead to significantly more infringement.” Additionally, Cloudflare removing infringing material from its cache would not prevent users from seeing the copyrighted images. “[R]emoving material from a cache without removing it from the hosting server would not prevent the direct infringement from occurring,” Chhabria wrote.

Security services “make no difference” to users

The plaintiffs also tried to prove contributory infringement by pointing to Cloudflare security services that detect suspicious traffic and prevent attacks on a website’s host. The judge dismissed this argument, writing:

Cloudflare’s security services also do not materially contribute to infringement. From the perspective of a user accessing the infringing websites, these services make no difference. Cloudflare’s security services do impact the ability of third parties to identify a website’s hosting provider and the IP address of the server on which it resides. If Cloudflare’s provision of these services made it more difficult for a third party to report incidents of infringement to the web host as part of an effort to get the underlying content taken down, perhaps it could be liable for contributory infringement. But here, the parties agree that Cloudflare informs complainants of the identity of the host in response to receiving a copyright complaint, in addition to forwarding the complaint along to the host provider.

The plaintiffs had also sought a summary judgment against the Doe defendants “but abandoned this motion in their reply brief,” the judge wrote.

https://arstechnica.com/?p=1802094