In 2018, Oakland enacted an innovative law giving citizens a voice in police use of surveillance technology. The Electronic Frontier Foundation called it “the new gold standard in community control of police surveillance.” Since then, about 20 other cities have adopted similar laws.

Now, Brian Hofer, one of the architects of Oakland’s law, says it’s not working. Earlier this month, Hofer filed suit against the city and the police department, saying they had repeatedly violated the law.

“We ignored human nature,” Hofer says in an interview. “Police don’t like to be transparent. Surveillance technology use is by design secretive, and no self-interested party is going to voluntarily highlight anything negative about their own proposal.” A spokesperson for the Oakland Police Department says it doesn’t comment on ongoing legal matters.

Even in Oakland, however, the law has given critics of police surveillance a platform. Indeed, Hofer sued under a provision of the law that allows citizens to take the city to court. He hopes it leads to the appointment of an independent counsel to review the police department’s data and assessment of surveillance tech.

“Like any law, [the surveillance ordinance] needs to be enforced,” says Matt Cagle, a staff attorney for the Technology and Civil Liberties Program at the ACLU of Northern California. “Which is why it’s so great to see people in Oakland and San Francisco use it to take the police to court.”

A national review of the laws—dubbed CCOPS, for Community Control of Police Surveillance—suggests other small successes. In Nashville, opposition from a community group created by such a law stopped—at least temporarily—a proposal for the city to buy automated license plate readers.

The laws vary in their specifics. Some require regular meetings between police and community members, annual audits for effectiveness and potential bias, greater transparency of vendors and the cost to taxpayers of any new tech, and a period of public comment before purchasing new tech such as body cameras or ShotSpotter, which uses microphones to detect gunfire.

In a student white paper released earlier this year, the Samuelson Law, Technology & Public Policy Clinic at the Berkeley School of Law said many of the ordinances are weaker than Oakland’s. New York City and Grand Rapids don’t empower citizens to file suit, as Oakland does. In six jurisdictions, including Cambridge, Massachusetts, and Palo Alto, California, police are exempt from the rules. So while a library or school would have to allow for public comment for new surveillance tools, police are exempt from restrictions if they’re executing a warrant or responding to a crisis.

Most of the cities give police broad latitude to use surveillance tech during “exigent circumstances.” Students Tyler Takemoto and Ari Chivukula, authors of the white paper, say this can create loopholes in citizen oversight.

“We know that different local governments considered, for example, racial justice uprisings last summer to fall within that category of extenuating exigent circumstances,” Takemoto says.

Acknowledging that there’s no perfect combination of rules, the authors suggest such ordinances empower citizens to sue and create independent bodies to oversee police and provide support. “Maybe the most important thing is the outside advice… a local nonprofit or community group that’s going to stay engaged,” Chivukula says. “If you don’t have public engagement, then there’s no pressure.”

The movement in Oakland toward reining in police surveillance began in 2014, when groups including the ACLU and EFF protested a proposed “Domain Awareness Center,” a fusion center combining microphones, CCTV, and surveillance data.

First created for port security, the city was moving toward approving a citywide expansion. The advocacy groups successfully campaigned to cancel the expansion and create a temporary privacy committee that would write policies for the city’s use of technology. This became an early iteration of the CCOPS model.

“With an ongoing reporting obligation, we would for the first time ever have real data to determine efficacy, inform policy decisions like retention limits and third-party access, and identify any civil liberties impact,” Hofer says. At the time, he says, “we did naively believe that law enforcement would be truthful in the presentation of data and when discussing the pros and cons of potential uses.”

In the suit, however, Hofer alleges Oakland police have refused to provide the necessary use policies for technologies that were in place before the ordinance took effect, and have allowed federal officials to access surveillance data without written requests, among other things. According to the suit, the police agreed to audit the use of license plate readers for bias and effectiveness, but haven’t produced any audits since 2018.

In 2017, Nashville formed a Community Oversight Board that pushed for a referendum where residents voted in favor of adopting a local version of CCOPS. Then, last year, city councilmember Courtney Johnston introduced a bill enabling police to purchase and install license plate readers, citing a nationwide crime spike and an ongoing street racing problem.

Andrés Martínez, the chair of the oversight board, helped rally opposition, citing reports questioning the effectiveness of the technology. The proposal has been deferred several times.

“In reality, when you look at what license plate readers actually do, it’s minimal compared to the amount of data that they capture,” Martinez says. “I think that our money and attention would be better served in trying to find actual community-based solutions to our public safety issues.”

This story originally appeared on wired.com.

https://arstechnica.com/?p=1798346

Just over four years ago, the US Department of Justice announced the takedown of AlphaBay, the biggest dark web market bust in history. Thai police arrested the site’s 26-year-old administrator, Alexandre Cazes, in Bangkok, and the FBI seized AlphaBay’s central server in Lithuania, wiping out a marketplace that was selling hundreds of millions of dollars a year worth of hard drugs, hacked data, and other contraband to its 400,000-plus registered users. The FBI called the disruption of the site a “landmark operation.”

But the fate of one key player in that massive black market scheme was never explained: AlphaBay’s former number-two administrator, security specialist, and self-described cofounder, who went by the name DeSnake. Now, four years after his market’s demise, DeSnake appears to be back online and has relaunched AlphaBay under his own singular leadership. After four years off the radar, he’s not keeping quiet about his return.

In an extended chat interview, DeSnake tells WIRED how he walked away unscathed from the takedown of AlphaBay, why he has resurfaced now, and what his plans are for the resurrected, once-dominant online black market. He communicated with WIRED via encrypted text messages, from a frequently changing series of pseudonymous accounts, after proving his identity by signing a public message with DeSnake’s original PGP key, which multiple security researchers verified.

“The biggest reason I am returning is to make the AlphaBay name be remembered as more than the marketplace which got busted and the founder made out to have committed suicide,” DeSnake writes. Cazes was found dead of an apparent suicide in a Thai jail cell a week after his arrest; like many in the dark web community, DeSnake believes Cazes was murdered in prison. He was driven to rebuild AlphaBay, he says, after reading about an FBI presentation on the circumstances of Cazes’ arrest that he deemed disrespectful. “AlphaBay name was put in bad light after the raids. I am here to make amends to that.”

A kind of practical paranoia permeated DeSnake’s messages to WIRED, both on a personal level and in his plans for AlphaBay’s revamped technical protections. (DeSnake says he uses male pronouns.) The revived version of AlphaBay, for instance, allows users to buy and sell only with the cryptocurrency Monero, which is designed to be far more difficult to trace than Bitcoin, whose blockchain has proven to sometimes allow powerful forms of financial tracking. AlphaBay’s dark web site is now accessible not only via Tor, like the original AlphaBay, but also I2P, a less popular anonymity system that DeSnake encourages users to switch to. He repeatedly described his wariness that Tor may be vulnerable to surveillance, though he provided no evidence.

DeSnake says his security practices—both the ones he’s applying within AlphaBay and on a personal level—go far beyond those of his predecessor, Cazes, who went by the online handle Alpha02. Cazes was caught, in part, through Bitcoin blockchain analysis that confirmed his role as AlphaBay’s boss, a trick that would be far more difficult, if not impossible, with Monero. DeSnake argues that new safeguards like these will make AlphaBay that much harder to remove from the dark web this time around. “I had given [Cazes] many ‘holy grails’ of anonymity, but he chose to use only certain things while he branded other methods/ways as ‘overkill,’” DeSnake writes, in his seemingly foreign-inflected and occasionally misspelled English. “In this game there is no overkill.”

DeSnake credits his ongoing freedom to an operational security regimen that borders on the extreme. He says his work computers run an “amnesiac” operating system, like the security-focused Tails distribution of Linux, designed to store no data. He claims, in fact, not to store any incriminating data on hard drives or USB drives at all, encrypted or not, and declined to explain further how he pulls off this apparent magic trick. DeSnake also claims to have prepared a USB-based “kill switch” device designed to wipe his computers’ memory and shut them off in seconds if they ever leave his control.

To avoid the risk of his PC being grabbed while he’s logged into AlphaBay, DeSnake says he also shuts it down entirely every time he steps away from it, even to take a bathroom break. “Biggest issue in that regard is the human needs … I would say that is the biggest inconvenience,” DeSnake writes. “You make sacrifices. Though once you get used to it, it becomes second nature.”

After all, law enforcement seized the laptops of Alexandre Cazes and Ross Ulbricht—the latter is serving a life sentence for running the original dark web drug market known as Silk Road–while they were open, running, and logged into administrator accounts on the dark web sites they oversaw. DeSnake, by contrast, makes the very bold claim that his work PC could not implicate him even if seized.

But all of those technical and operational protections may matter less than a simple geographic one. DeSnake claims to be located in a non-extradition country, beyond the reach of US law enforcement. In messages to WIRED, AlphaBay’s new boss describes having lived in the former USSR, and he previously wrote Russian-language messages to users on the original AlphaBay’s forums.

AlphaBay has long been rumored to have some sort of connections to Russia or Russians. Its rules have always banned the sale of data stolen from victims in former USSR countries, a common prohibition among Russian hackers intended to shield them from Russian law enforcement scrutiny. And when Alexandre Cazes wrote under the Alpha02 moniker on the site, he sometimes signed off with a Russian phrase for “stay safe.” But when Cazes was later tracked down in Thailand, many assumed AlphaBay’s Russian fingerprints had been designed to mislead investigators.

DeSnake now claims, however, that he and others involved in the original AlphaBay do in fact remain beyond the reach of Western law enforcement. “You do not shit where you sleep,” he writes of AlphaBay’s rule against selling the stolen data of ex-Soviet citizens. “We did that for security of other staff members. [Cazes] decided to embrace it as a way to secure himself.”

Regardless, DeSnake claims that he has traveled to “several continents within the last 4 years” and “had zero problems,” leading him to believe that his years of freedom have been a result not only of his location but of having technically outmaneuvered the law enforcement agencies tracking him. Of course, everything DeSnake told WIRED may itself be misdirection designed to help him further evade those agencies.

When WIRED reached out to Justice Department officials, including one who participated in the original investigation of AlphaBay that resulted in its 2017 takedown, they either didn’t respond or declined to comment.

While few of DeSnake’s claims can be confirmed, he has at least enjoyed unusual longevity for a dark web market operator. Security firm Flashpoint says it has seen evidence and descriptions of DeSnake operating under the same pseudonym—first as a credit-card-focused cybercriminal on sites like Evolution and Tor Carder Forum before becoming a market administrator himself—since at least 2013.

DeSnake first appeared on the original AlphaBay’s forums in the fall of 2014, a vendor of credit card fraud—also known as “carding”—tools and guides, looking for a new home after the administrators of Evolution absconded with their users’ money in a so-called “exit scam.” He says he quickly befriended Alpha02 by an unorthodox method: He claims he “popped a shell” on AlphaBay, hacking the website and gaining a foothold to run his own commands on its server. Rather than exploit that breach, he says, he helped the administrator fix it and soon became the site’s number-two admin and security lead. “I took care of the security and certain admin stuff,” DeSnake says. “He took care of the rest.”

Nearly three years later, Cazes was arrested and the site torn offline, thanks in part to a trail of evidence that began when the AlphaBay founder leaked a personal email address in the metadata of a welcome message to new users on its forums, a problem DeSnake says he had fixed early on by switching the site’s forum software. “I am still in disbelief to this day that he had put his personal email on there,” DeSnake says. “He was a good carder and he knew better opsec.”

Dark web buyers and vendors haven’t exactly flocked back to AlphaBay’s since its return. A few weeks into the relaunch, it has just under 500 listings, compared to more than 350,000 at AlphaBay’s 2017 peak. Those low numbers likely stem from DeSnake’s insistence on accepting only Monero, from skeptical dark web users waiting to see if the new AlphaBay is legitimate, and from a barrage of distributed denial-of-service attacks that have knocked the site offline since its launch. But DeSnake argues that dark web markets typically gain an influx of new users only when another popular market shuts down or is busted by law enforcement; neither has happened since AlphaBay came back.

In the meantime, DeSnake wants to attract users with promises of a still-unproven system he calls AlphaGuard, designed to let users withdraw their funds even if authorities once again seize the servers that run AlphaBay’s infrastructure.

As DeSnake describes it, AlphaGuard will automatically rent and set up new servers if it detects that AlphaBay’s are being taken offline. He even claims that AlphaGuard will automatically hack other websites and plant data on their servers to give users “withdrawal codes” they can use to save the cryptocurrency they’ve stored on AlphaBay in case of a takedown. “It is a system to ensure users can withdraw funds, settle disputes, and generally go without a cent lost if raids happen,” DeSnake writes, “even if it happens on all servers at the same time. It is unstoppable.”

If that AlphaGuard feature doesn’t sound aspirational enough, DeSnake says he’s also in the early stages of a long-term plan to implement a fully decentralized marketplace system, essentially a BitTorrent to the current dark web markets’ Napster. In that hyper-ambitious plan, open source programmers and server operators who independently run hundreds or thousands of servers would be paid a portion of profits for hosting markets that would form a vast dark web network with no single point of failure. AlphaBay, DeSnake says, would be one of the “brands” hosted on that network, but any vendor or market could choose to set up their own, with encryption features that would keep each market or store under that administrator’s control even as its code is duplicated across a vast array of machines.

DeSnake has discussed that decentralization project since his earliest posts to the AlphaBay forums, and he acknowledges that it’s still years away. But he sees it as a way to both make AlphaBay invulnerable to future law enforcement takedowns and to pay back the dark web’s users for the millions they lost when the original AlphaBay server was seized. “When it comes to the money making this is investment in the future of AlphaBay,” DeSnake writes. “When it comes to ideology I think that is pretty clear. The reason is to make good to the AlphaBay name … this is our way to reimburse the darknet scene for what has happened.”

But all of the defensive wizardry that DeSnake describes—both AlphaGuard and the decentralization project—remain largely unproven talk, says Flashpoint analyst Ian Gray, who closely monitors dark web markets. The decentralization plan, for instance, would require collective buy-in from a large number of developers and network operators for what would likely be seen as an essentially illegal project. Gray points out that DeSnake hasn’t published any code for either that system or AlphaGuard, and questions why he would relaunch AlphaBay four years after its takedown without any real progress toward his decentralization dream. “He hasn’t really demonstrated anything besides launching a marketplace,” Gray says. “I’m distrustful of DeSnake, and I think across the communities there’s a general distrust.”

Gray points to a thread on the largely Russian cybercrime forum XSS, where many commenters expressed their skepticism about DeSnake’s return, some implying that he’s being controlled by law enforcement. “Lol, how many honest comrades will DeSnake have to turn in now to leave the punishment cell?” one commenter asked in Russian. “It’s fake and 99.9% sure and feds opening it again,” another wrote.

One former US law enforcement official involved in the original AlphaBay investigation, who asked not to be named, also expressed doubts. “If I were a vendor or user on this site, I would be very concerned with it being either set up for an exit scam or some type of honeypot operation,” the former official said, noting that they’re not aware of any ongoing law enforcement operations that may be targeting the site.

Nicolas Christin, a dark-web-focused computer scientist at Carnegie Mellon University, verified DeSnake’s PGP key against a copy found in his own archive of messages. But that key, he says, could be in the control of law enforcement agencies, or DeSnake himself could have become a law enforcement cooperator. After all, at the same time as AlphaBay’s 2017 takedown, the Dutch police took over and controlled Hansa, the second-largest dark web market at the time. “It’s unlikely,” Christin says of theories that DeSnake is compromised, “but not impossible.”

DeSnake counters that if law enforcement had gotten to him and launched the new AlphaBay as a honeypot, they would have simply reused the original AlphaBay’s code. Instead, he says, he rewrote it from scratch. And he points out that the Monero-only restriction for the site would make it far less effective for trapping unsuspecting dark web buyers than a site that simply accepts Bitcoin.

“With all of that said you decide for yourself whether you ride the wave with us to the top and beyond,” he wrote in a message to users on the dark web market forum Dread. “I understand if you decide not to but over time you will be proven that we are the original AB and we have never been ‘compromised’ in any way shape or form.”

If DeSnake and his revitalized AlphaBay are in fact legit, they may prove to be the opposite of a honeypot: A highly motivated digital black market seemingly beyond the grasp of US law enforcement. And that might well mean that the long track record of one of the dark web’s oldest players still has no clear end in sight.

This story originally appeared on wired.com.

https://arstechnica.com/?p=1798352

Bitcoin’s massive power consumption is the cryptocurrency’s dirty secret. To mine bitcoin, computers across the globe chew through enough electricity to power a medium size country, somewhere on the order of the Netherlands or Poland depending on the estimate.

In fact, electricity has become such a significant factor that one private equity firm owns a power plant to mine bitcoin. The company, Greenidge Generation, said at one point that they could mine one bitcoin for less than $3,000. Even today—at $40,000 per bitcoin, some 30 percent off its peak—the potential for profit is real.

Which is why an investor-owned utility has dropped a containerized data center outside a coal-fired power plant 10 miles north of St. Louis. Ameren, the utility, was struggling to keep the 1,099 MW power plant running profitably when wholesale electricity prices dropped. But it wasn’t well suited to running only when demand was high, so-called peaker duty. Instead, they’re experimenting with running it full-time and using the excess electricity to mine bitcoin.

Can’t cope with the load

Ameren executives reportedly blame wind and solar power for the load variability that taxes the 55-year-old power plant. The utility claims that mining bitcoin could reduce its carbon footprint by allowing it to run its plants more consistently rather than ramping them up and down, which they say can increase emissions.

“We have pretty dramatic changes in load minute by minute, second by second at times,” Warren Wood, the utility’s vice president of regulatory and legislative affairs, told E&E News. But when it’s running full-time, they only have to take power away from the mining operations. Wood said it takes about 20 seconds to divert power back to the grid.

Compared with gas peakers, which typically need at least five minutes to ramp up to full capacity, that’s pretty quick. But it’s also incredibly slow when compared with grid-scale batteries, which can respond within milliseconds.

Across the entire grid, cryptocurrency mining operations could “add a lot of value, particularly how fast they can move up and down, Joshua Rhodes, a research associate at the University of Texas at Austin, told E&E News. “It can have a positive emissions impact if it’s run the right way,” he said. “It can also increase emissions if it’s not.”

“Slippery slope”

Ameren attempted to get rate payers to foot a portion of the bill for its experiment, but Missouri’s consumer advocate pushed back. “If Ameren Missouri wants to enter into speculative commodities, like virtual currencies, then it should do so as a non-regulated service where ratepayers are unexposed to the economics of them,” Geoff Marke, chief economist for the Missouri Office of the Public Counsel, wrote in a filing. “This endeavor is beyond the scope of intended electric utility regulation, and, if allowed, creates a slippery slope where ratepayers could be asked to put up capital for virtually anything.”

The utility says that if its bitcoin experiment pans out, it could attach similar containerized data centers to wind and solar farms to soak up excess electricity profitably in times of high supply or low demand. The coal-fired power plant that’s being used in the experiment is scheduled to be shut down in 2028.

Ameren says that so far it’s pleased with the project, which has mined 20 coins and mints a new one at a rate of one every 15 days or so. Whether the math continues to work depends largely on the cost of running the plant and the price of bitcoin, which is highly volatile. Based on today’s prices, the company has made about $800,000 since it switched on the miners in April.

https://arstechnica.com/?p=1798372

China’s crackdown on cryptocurrencies intensified today, with the country’s central bank announcing that all crypto-related transactions are illegal.

“There are legal risks for individuals and organizations participating in virtual currency and trading activities,” the People’s Bank of China said in a statement jointly issued with nine other government bodies. Even Chinese nationals working overseas weren’t exempt, with the government saying that they, too, would be “investigated according to the law,” according to a report in the Financial Times.

Bitcoin and other cryptocurrencies dropped on the news. Currently, bitcoin was down 4.5 percent at the time of publication, and ethereum was down 7.5 percent.

The move follows earlier Chinese Communist Party messaging that banned cryptocurrency mining and warned financial institutions not to participate in such transactions. The crypto crackdown comes as China’s real estate developers are facing a liquidity crunch that risks infecting the rest of the economy.

Domino effect

Real estate represents almost a third of China’s gross domestic product, and developers have borrowed heavily to ride the wave. But in recent years, the Chinese Communist Party has turned on the sector after President Xi Jinping said in 2017 that “houses are for living in, not for speculation.”

Xi may not simply be motivated by ideology here—as migration to cities has slowed and birthrates have fallen, the country has become riddled with unfinished or unoccupied housing. The Rhodium Group estimates that the market’s excess could house as many as 90 million people.

Local governments have slowed land sales substantially, down 90 percent year over year. Since they rely on land sales for about a third of their revenues, the loss could have a domino effect, reducing local governments’ abilities to repay the $8.4 trillion in debt they’ve issued.

In August, Beijing attempted to further rein in the sector, demanding that developers lower the ratio of debt they hold to assets they own. Real estate companies are often highly leveraged, selling debt to build and market developments, relying on sales to pay down that debt. The nation’s second largest developer, Evergrande, has been caught flat footed by the Communist Party’s new demands. Before the decree, it was already in trouble. As property sales have slowed, Evergrande hasn’t been able to generate the cash required to finish projects. And without finishing those projects, it wasn’t generating cash to pay interest and principal on its outstanding debts. The government has prevented Evergrande from issuing new bonds to pay off its near-term debt, and the company now runs the very real risk of default.

Some observers are comparing the Evergrande crisis to Lehman Brothers, the American brokerage firm that went belly-up in 2008 at the outset of the subprime mortgage crisis. Others don’t think that the Community Party will allow an Evergrande default to create the same ripple effect, but investors are nonetheless spooked. If Evergrande’s woes do send shockwaves throughout the Chinese economy, investors may attempt to move their money elsewhere, out of China.

Capital outflows

All of that brings us to where the continued cryptocurrency crackdown comes in. The Chinese government has long restricted the flow of capital outside the country, preferring that investors keep it circulating within the nation’s economy. But cryptocurrencies are more challenging to control given their somewhat anonymous nature and the relative ease with which they can be converted into other countries’ currencies. 

The crypto crackdown in China is not just because bitcoin mining had been drawing too much power, which it had been, or because it was commonly used in illicit transactions, which it was. It’s because the Chinese government likely recognizes the risks posed by an over-leveraged real estate sector, and it’s attempting to limit the fallout when the correction comes. Cryptocurrencies are simply caught in the crossfire.

https://arstechnica.com/?p=1798222

In a newly unsealed lawsuit, Facebook shareholders allege that the company intentionally overpaid a $5 billion Federal Trade Commission fine to protect CEO Mark Zuckerberg from further government scrutiny.

“Zuckerberg, Sandberg, and other Facebook directors agreed to authorize a multi-billion settlement with the FTC as an express quid pro quo to protect Zuckerberg from being named in the FTC’s complaint, made subject to personal liability, or even required to sit for a deposition,” the lawsuit says (emphasis in the original). An early draft of the order obtained by The Washington Post through the Freedom of Information Act shows that the commission was considering holding Zuckerberg responsible.

The FTC levied the fine in July 2019 in the wake of the Cambridge Analytica scandal, which saw political operatives harvesting the personal data of 50 million Facebook users without their consent. (The lawsuit says only 0.31 percent of the affected users consented.) The fine (which was a record for privacy-related penalties) was 50 times larger than the maximum prescribed by a previous FTC consent decree, the lawsuit alleges. It was also well in excess of the previous record fine of $168 million.

“Facebook’s maximum monetary exposure was $104,751,390—about $4.9 billion less than it agreed to pay,” shareholders said in the lawsuit. The overpayment, they said, is a breach of fiduciary duty.

Insider trading

The lawsuit also alleges that, by withholding information about the Cambridge Analytica leak, executives and board members, including Zuckerberg and COO Sheryl Sandberg, engaged in insider trading. “After Zuckerberg learned of Cambridge Analytica’s massive extraction of Facebook user data, he and the entities controlled by him significantly accelerated his sales of Facebook shares,” the lawsuit says.

The shareholders filed the lawsuit in Delaware’s Court of Chancery. Among the plaintiffs are a handful of pension and retirement funds, including the massive California State Teachers’ Retirement System, which manages over $250 billion. The defendants include Mark Zuckerberg, Facebook COO Sheryl Sandberg, several other executives, and members of the board at the time of the settlement, including Peter Thiel, Mark Andreessen, and Jan Koum, among others.

A second lawsuit, which has been consolidated with the first, also names Palantir Technologies, Thiel’s big data analytics firm. That lawsuit alleges tight ties between Palantir and Cambridge Analytica, citing a 2019 book by whistleblower Christopher Wylie. Wylie reported that several Palantir employees, including one of the company’s lead data scientists, routinely worked at Cambridge Analytica’s offices “in person, during normal business hours,” the lawsuit says. “The two companies were so intertwined that, as the Stanford Daily reported in April 2018, Palantir earned itself the moniker ‘Stanford Analytica.'” Palantir reportedly took steps to obscure the relationship.

Thiel was one of former President Donald Trump’s biggest supporters in the run-up to the 2016 election. The Trump campaign and Trump-aligned PACs both hired Cambridge Analytica to help run digital operations.

Ties between Zuckerberg, Thiel, and the Trump administration apparently ran deep. In October 2019, Zuckerberg reportedly met with Thiel, Trump, and Jared Kushner at the White House. “Thiel later told a confidant that Zuckerberg came to an understanding with Kushner during the meal. Facebook, he promised, would continue to avoid fact-checking po­litical speech,” Max Chafkin said in an excerpt from his new book. “If the company followed through on that promise, the Trump administra­tion would lay off on any heavy-handed regulations. After the dinner, Zuckerberg took a hands-off approach to conservative sites.”

Tarnished image

The events of the last few years—from the Cambridge Analytica scandal to the platform’s role in the January insurrection at the US Capitol—have tarnished Facebook’s public image. Zuckerberg apparently wants that to change, and The New York Times is reporting that he has personally signed off on at least three new initiatives, including one known as Project Amplify that pushes Facebook PR into user’s feeds.

Executives from several parts of the company, including marketing, communications, policy, and integrity teams have all been involved, the Times reports. The main driver behind the changes is Alex Schultz, Facebook’s chief marketing officer, though Zuckerberg reportedly approved them all. Schultz apparently was the driving force behind an effort to restrict access to data for researchers and journalists. Instead, he preferred to release Facebook’s own spin, and the first report was only released last month. The first report was reportedly shelved out of concerns that the top link on the site that quarter was contributing to COVID-vaccine hesitancy.

Another initiative, known as Project Amplify, reportedly injects pro-Facebook content into people’s News Feeds. Joe Osborne, a Facebook spokesperson, has denied any changes to the News Feed’s ranking algorithm. Yet judging by the New York Times article, such changes may not be necessary. The company reportedly uses a tool known as Quick Promote to inject the content, which includes links to articles written by Facebook or third parties that cast the company in a positive light. The PR posts are flagged with small Facebook logos. Osborne said the posts are “similar to corporate responsibility initiatives people see in other technology and consumer products,” a statement which elides the fact that most other companies don’t have ready access to more than 2 billion people.

The company has insisted that many of the recent stories written about it—from the aforementioned article revealing Project Amplify to the extensive Wall Street Journal expose—contain falsehoods. “These stories have contained deliberate mischaracterizations of what we are trying to do,” Nick Clegg, Facebook’s vice president of global affairs, wrote in a blog post.

If Facebook is truly using its platform to improve its image, expect more stories with a positive spin to appear in News Feeds in the coming months: the whistleblower behind the WSJ’s series has turned over documents to lawmakers, The Washington Post reports. The person reportedly intends to go public by the end of the year, possibly by testifying before a Senate panel.

https://arstechnica.com/?p=1797908

Facebook had it rough last week. Leaked documents—many leaked documents—formed the backbone of a string of reports published in The Wall Street Journal. Together, the stories paint the picture of a company barely in control of its own creation. The revelations run the gamut: Facebook had created special rules for VIPs that largely exempted 5.8 million users from moderation, forced troll farm content on 40 percent of America, created toxic conditions for teen girls, ignored cartels and human traffickers, and even undermined CEO Mark Zuckerberg’s own desire to promote vaccination against COVID.

Now, Facebook wants you to know it’s sorry and that it’s trying to do better.

“In the past, we didn’t address safety and security challenges early enough in the product development process,” the company said in an unsigned press release today. “Instead, we made improvements reactively in response to a specific abuse. But we have fundamentally changed that approach.”

The change, Facebook said, was the integration of safety and security into product development. The press release doesn’t say when the change was made, and a Facebook spokesperson couldn’t confirm for Ars when integrity became more embedded in the product teams. But the press release does say the company’s Facebook Horizon VR efforts benefitted from this process. Those were released to beta only last year.

The release would appear to confirm that, prior to development of Horizon, safety and security were sideshows that were considered after features had been defined and code had been written. Or, maybe problems weren’t addressed until even later, when users encountered them. Regardless of when it happened, it’s a stunning revelation for a multibillion dollar company that counts 2 billion people as users.

Missed the memo

Facebook isn’t the first company to have a cavalier approach to security, and as such, it didn’t have to make the same mistakes. Early in Facebook’s history, all it had to do was look as far as one of its major shareholders, Microsoft, which had bought special stock in the startup in 2007.

In the late 1990s and early 2000s, Microsoft had its own issues with security, producing versions of Windows and Internet Information Server that were riddled with security holes. The company began to fix things after Bill Gates made security the company’s top priority in his 2002 “Trustworthy computing” memo. One result of that push was the Microsoft Security Development Lifecycle, which implores managers to “make security everyone’s business.” Microsoft began publishing books about its approach in the mid-2000s, and it’s hard to imagine that Facebook’s engineers were unaware of it.

But a security-first development program must have come with costs that Facebook was unwilling to bear—namely, growth. Time and again the company has been confronted with choices about whether to address a safety or security problem or prioritize growth. It has ignored privacy concerns by allowing business partners to access users’ personal data. It killed a project to use artificial intelligence to tackle disinformation on the platform. It’s focus on Groups a few years ago led to “super-inviters” able to recruit hundreds of people to the “Stop the Steal” group that ultimately helped foment the January 6 insurrection at the US Capitol. In each case, the company had chosen to pursue growth first and deal with the consequences later.

“Many different teams”

That mindset appears to have been baked into the company from the beginning, when Zuckerberg took an investment from Peter Thiel and copied the “blitzscaling” strategy that Thiel and others used at PayPal.

Today, Facebook is fracturing under the internal strife caused by growth at all costs. The leaks to the WSJ, said Alex Stamos, the company’s former chief security officer, are the result of frustrations the safety and security people experience when they’re overruled by growth and policy teams. (Policy teams have their own conflicts—the people who decide what flies on Facebook are the same ones talking with politicians and regulators.) 

“The big picture is that several mid-level VPs and Directors invested and built big quantitative social science teams on the belief that knowing what was wrong would lead to positive change. Those teams have run into the power of the Growth and unified Policy teams,” Stamos tweeted this week. “Turns out the knowledge isn’t helpful when the top execs haven’t changed the way products are measured and employees are compensated.”

Even today, there doesn’t appear to be one person who is responsible for safety and security at the company. “Our integrity work is made up of many different teams, so hard to say [if there is] one leader, but Guy Rosen is VP of Integrity,” a Facebook spokesperson told Ars. Perhaps it’s telling that Rosen doesn’t appear on Facebook’s list of top management.

For now, Facebook doesn’t seem to have much incentive to change. Its stock price is up more than 50 percent over the last year, and shareholders don’t have much leverage given the outsize power of Zuckerberg’s voting shares. Growth at all costs will probably continue. Until, of course, the safety and security problems become so large that they start harming growth and retention. Given Facebook’s statement today, it’s not clear whether the company is there yet. If that moment arrives—and if Microsoft’s transition is anything to go by—it will be years before an embrace of safety and security affects users in a meaningful way.

https://arstechnica.com/?p=1797126

In video game parlance, longtime gaming publisher Activision Blizzard has jumped to “extreme” difficulty as of late, thanks to a wave of highly publicized lawsuits. On Monday, the company behind World of Warcraft, Diablo, and Call of Duty faced arguably its biggest test yet, this time from the federal government.

The Securities and Exchange Commission is investigating Activision Blizzard over how the video game publisher dealt with allegations of sexual misconduct and workplace discrimination—and whether related information was properly disclosed to shareholders by executives.

The federal regulator has subpoenaed the company as well several senior executives, including CEO Bobby Kotick, according to The Wall Street Journal. It has also requested a variety of documents, including Kotick’s communications with other executives regarding the matter, minutes from board meetings held since 2019, the personnel files of six former employees, and separation agreements written this year. Former employees also reportedly have been subpoenaed.

Activision confirmed the SEC investigation in a statement to the WSJ, saying that the company is cooperating with the agency.

Earlier this year, Activision Blizzard was accused of fostering a “frat boy” culture in a lawsuit brought against it by the California Department of Fair Employment and Housing. In the filing, the agency claims that the Santa Monica-headquartered company paid women less, gave them fewer opportunities for advancement, and created a “breeding ground for harassment and discrimination against women.”

“Blatant sexual harassment”

Sexual harassment was allegedly rampant. “High-ranking executives and creators engaged in blatant sexual harassment without repercussions.” In one terrible incident, a female employee committed suicide while on a work trip with a male supervisor, who allegedly harassed her during the trip.

The lawsuit also claims that former Senior Creative Director Alex Afrasiabi “was permitted to engage in blatant sexual harassment,” including openly hitting on female employees, trying to kiss them, telling them he wanted to marry them, and more. Other male employees and supervisors had to physically pull him off his female colleagues, the lawsuit says. Afrasiabi’s behavior was tolerated with “little to no repercussions.” Among Afrasiabi’s supervisors was Blizzard President J. Allen Brack, who the lawsuit says received reports from employees about the alleged behavior but only gave the creative director a “slap on the wrist.”

Afrasiabi was fired from the company in early 2020 for “misconduct in his treatment of other employees,” Activision Blizzard confirmed, and Brack left the company last month. In August, Activision also confirmed the departure of other employees, including Luis Barriga (former director of Diablo IV), Jesse McCree (a former Diablo IV designer), and Jonathan LeCraft (former World of Warcraft designer) without specifying why they left. McCree and LeCraft were seen in photos published by Kotaku that tied them to an alcohol-fueled BlizzCon 2013 after-party in what some staffers called the “Cosby Suite.”

Under pressure

Brack’s resignation came on the heels of a shareholder lawsuit that said the company “artificially inflated” the value of the stock and made “false and misleading statements” by withholding details on harassment, discrimination, and misconduct. Activision Blizzard’s SEC filings, the shareholder lawsuit says, included boilerplate language about business risks posed by lawsuits against the company. That language, the shareholder lawsuit alleges, obscured the “numerous complaints about unlawful harassment, discrimination, and retaliation [that] were made to human resources (“HR”) personnel and executives which went unaddressed.”

Indeed, Activision Blizzard’s stock price dropped more than 6 percent on July 27, the day after the California lawsuit was made public, and has slid further since.

The company’s initial response to the California lawsuit drew harsh criticism from employees, who circulated a petition calling for the company to acknowledge the “seriousness of the allegations.” “To claim this is a ‘truly meritless and irresponsible lawsuit,’ while seeing so many current and former employees speak out about their own experiences regarding harassment and abuse, is simply unacceptable,” it said. Later that week, employees organized a walkout to “end mandatory arbitration clauses” that “protect abusers and limit the ability of victims to seek restitution” as well as new hiring and compensation practices.

The SEC investigation comes as Activision Blizzard is planning to release Diablo II: Resurrected on September 23.

https://arstechnica.com/?p=1796859

Amid ever-increasing government Internet control, surveillance, and censorship in Iran, a new Android app aims to give Iranians a way to speak freely.

Nahoft, which means “hidden” in Farsi, is an encryption tool that turns up to 1,000 characters of Farsi text into a jumble of random words. You can send this mélange to a friend over any communication platform—Telegram, WhatsApp, Google Chat, etc.—and then they run it through Nahoft on their device to decipher what you’ve said.

Released last week on Google Play by United for Iran, a San Francisco–based human rights and civil liberties group, Nahoft is designed to address multiple aspects of Iran’s Internet crackdown. In addition to generating coded messages, the app can also encrypt communications and embed them imperceptibly in image files, a technique known as steganography. Recipients then use Nahoft to inspect the image file on their end and extract the hidden message.

Iranians can use end-to-end encrypted apps like WhatsApp for secure communications, but Nahoft, which is open source, has a crucial feature in its back pocket for when those aren’t accessible. The Iranian regime has repeatedly imposed near-total Internet blackouts in particular regions or across the entire country, including for a full week in November 2019. Even without connectivity, though, if you already have Nahoft downloaded, you can still use it locally on your device. Enter the message you want to encrypt, and the app spits out the coded Farsi message. From there you can write that string of seemingly random words in a letter, or read it to another Nahoft user over the phone, and they can enter it into their app manually to see what you were really trying to say.

“When the Internet goes down in Iran, people can’t communicate with their families inside and outside the country, and for activists everything comes to a screeching halt,” says Firuzeh Mahmoudi, United for Iran’s executive director, who lived through the 1979 Iranian revolution and left the country when she was 12. “And more and more the government is moving toward layered filtering, banning different digital platforms, and trying to come up with alternatives for international services like social media. This is not looking great; it’s the direction that we definitely don’t want to see. So this is where the app comes in.”

Iran is a highly connected country. More than 57 million of its 83 million citizens use the Internet. But in recent years the country’s government has been extremely focused on developing a massive state-controlled network, or intranet, known as the “National Information Network” or SHOMA. This increasingly gives the government the ability to filter and censor data, and to block specific services, from social networks to circumvention tools like proxies and VPNs.

This is why Nahoft was intentionally designed as an app that functions locally on your device rather than as a communication platform. In the case of a full Internet shutdown, users will need to have already downloaded the app to use it. But in general, it will be difficult for the Iranian government to block Nahoft as long as Google Play is still accessible there, according to United for Iran strategic adviser Reza Ghazinouri. Since Google Play traffic is encrypted, Iranian surveillance can’t see which apps users download. So far, Nahoft has been downloaded 4,300 times. It’s possible, Ghazinouri says, that the government will eventually develop its own app store and block international offerings, but for now that capability seems far off. In China, for example, Google Play is banned in favor of offerings from Chinese tech giants like Huawei and a curated version of the iOS App Store.

Ghazinouri and journalist Mohammad Heydari came up with the idea for Nahoft in 2012 and submitted it as part of United for Iran’s second “Irancubator” tech accelerator, which started last year. Operator Foundation, a Texas nonprofit development group focused on Internet freedom, engineered the Nahoft app. And the German penetration testing firm Cure53 conducted two security audits of the app and its encryption scheme, which draws from proven protocols. United for Iran has published the findings from these audits along with detailed reports about how it fixed the problems Cure53 found. In the original app review from December 2020, for example, Cure53 found some major issues, including critical weaknesses in the steganographic technique used to embed messages in photo files. All of these vulnerabilities were fixed before the second audit, which turned up more moderate issues like Android denial-of-service vulnerabilities and a bypass for the in-app auto-delete passcode. Those issues were also fixed before launch, and the app’s Github repository contains notes about the improvements.

The stakes are extremely high for an app that Iranians could rely on to circumvent government surveillance and restrictions. Any flaws in the cryptography’s implementation could put people’s secret communications, and potentially their safety, at risk. Ghazinouri says the group took every precaution it could think of. For example, the random word jumbles the app produces are specifically designed to seem inconspicuous and benign. Using real words makes it less likely that a content scanner will flag the coded messages. And United for Iran researchers worked with Operator Foundation to confirm that current off-the-shelf scanning tools don’t detect the encryption algorithm used to generate the coded words. That makes it less likely that censors will be able to detect encoded messages and create a filter to block them.

You can set a passcode needed to open Nahoft and set an additional “destruction code” that will wipe all data from the app when entered.

“There has always been a gap between communities in need and the people who claim to work for them and develop tools for them,” Ghazinouri says. “We’re trying to shrink that gap. And the app is open source, so experts can audit the code for themselves. Encryption is an area where you can’t just ask people to trust you, and we don’t expect anyone to trust us blindly.”

In a 2020 academic keynote, “Crypto for the People,” Brown University cryptographer Seny Kamara made a similar point. The forces and incentives that typically guide cryptographic inquiry and creation of encryption tools, he argued, overlook and dismiss the specific community needs of marginalized people.

Kamara has not audited the code or cryptographic design of Nahoft, but he told WIRED that the goals of the project fit with his ideas about encryption tools made by the people, for the people.

“In terms of what the app is trying to accomplish, I think this is a good example of an important security and privacy problem that the tech industry and academia have no incentive to solve,” he says.

With Iran’s Internet freedom rapidly deteriorating, Nahoft could become a vital lifeline to keep open communication going within the country and beyond.

This story originally appeared on wired.com.

https://arstechnica.com/?p=1796375

Being a global company has its perks. There’s a lot of money to be made overseas. But the biggest US tech companies are finding out that there’s also a downside: Every country where you make money is a country that could try to regulate you.

It’s hard to keep track of all the tech-related antitrust action happening around the world, in part because it doesn’t always seem to be worth paying close attention to. In Europe, which has long been home to the world’s most aggressive regulators, Google alone was hit with a $2.7 billion fine in 2017, a $5 billion fine in 2018, and a $1.7 billion fine in 2019. These sums would be devastating for most companies, but they are little more than rounding errors for a corporation that reported $61.9 billion in revenue last quarter.

Increasingly, however, foreign countries are going beyond slap-on-the-wrist fines. Instead, they’re forcing tech companies to change how they do business. In February, Australia passed a law giving news publishers the right to negotiate payments from dominant internet platforms—effectively, Facebook and Google. In August, South Korea became the first country to pass a law forcing Apple and Google to open their mobile app stores to alternate payment systems, threatening their grip on the 30 percent commission they charge developers. And in a case with potentially huge ramifications, Google will soon have to respond to the Turkish competition authority’s demand to stop favoring its own properties in local search results.

The consequences of cases like these can ripple far beyond the borders of the country imposing the new rule, creating natural experiments that regulators in other countries might emulate. The fact that Google and Facebook have acquiesced to Australia’s media bargaining code, for example, might accelerate similar efforts in other countries, including Taiwan, Canada, and even the US. Luther Lowe, who as Yelp’s senior vice president of public policy has spent more than a decade lobbying for antitrust action against Google, refers to this phenomenon, approvingly, as “remedy creep.”

In other cases, the companies being forced to change their business model abroad might decide to adopt the shift globally before they’re forced to. After settling an investigation by Japan’s Fair Trade Commission, Apple decided to implement the solution—allowing audio, video, and reading apps to link to their own websites to accept payment—globally.

“Sometimes it’s the market driving it: The companies decide it’s too costly to make different compliance strategies in different markets,” said Anu Bradford, a professor of international and antitrust law at Columbia University. “Or, sometimes, it’s in anticipation of copycat regulation: They know it’s out there, and they’re not going wait for the Russians or Turkish to do their own case.”

While it hasn’t gotten quite the same level of media attention as Australia and South Korea, the case in Turkey could end up being the biggest deal. That’s because it cuts to the heart of how Google uses its power as the gatekeeper for most internet traffic.

The case is about what’s called local search, like when you look for “restaurants near me” or “hardware store.” This is a huge category of search traffic—nearly half of all Google searches, according to some analysts. Google’s critics and competitors have long complained that Google unfairly uses its dominance to steer local search results to its own offerings, even when that might not be the most helpful result. Think about how, if you search on Google for “Chinese restaurant,” the top of the results page will probably feature a widget that Google calls the OneBox. It will include section of Google Maps and a few Google reviews of Chinese restaurants near you. You’ll have to scroll down to find the top organic results, which may be from Yelp or TripAdvisor.

This dynamic has exasperated Google critics and competitors for years. One of those aggrieved competitors, Yelp, initiated the case in Turkey by lodging a complaint with the country’s competition authority. Google argues that its local search results are designed to be maximally helpful for users, not to pad its own bottom line. But the Turkish regulators disagreed, concluding that Google “has violated Article 6 of the Turkish Competition Law by abusing its dominant position in the general search services market to promote its local search and accommodation price comparison services in a way to exclude its competitors.” (I’m quoting a translation provided by a Turkish lawyer.) In April they imposed a fine of about $36 million. That’s less than Google earned every two hours, on average, in 2020. But while the fine was trivial, the rest of the decision was not. The authority issued a preliminary ruling ordering Google to come up with a way of displaying local search results that doesn’t favor itself over competitors.

For now, the case is in limbo. The competition authority still has to issue a “reasoned opinion” laying out its conclusions in detail. Then, Google will get the chance to submit its proposal for complying with the ruling. It will be up to the competition authority to decide whether that proposal is good enough or not.

This isn’t Google’s first rodeo in Ankara. In 2018 the competition authority made a similar ruling about Google Shopping, finding that Google privileged itself over other comparison-shopping sites. This came on the heels of an analogous European Union case, but with an important difference: In that case, the EU accepted Google’s solution, even though its competitors argued it was inadequate. The Turkish authorities did not. That gave Google a choice: come back with a solution the regulators would accept, or pull the plug on Google Shopping in Turkey. The company chose the latter option, simply shutting down its comparison shopping module in the country.

Google could do the same thing in the current case. But the stakes would be far higher. Local search is a much bigger share of the overall search pie, and Turkey, with a population of 85 million people, is a big place. Giving up on local search would be taking away a commonly used feature in a large market. That means the company has a greater incentive to propose a fix that won’t get rejected by the competition authority. But that in turn raises a complimentary risk: Any solution adopted in Turkey could be demanded elsewhere.

“If you’re one of these globally dominant companies, the downside is, if one of those jurisdictions becomes a live example in the wild of an antitrust remedy, there’s a huge domino-effect risk,” said Yelp’s Luther Lowe. “Because suddenly, Amy Klobuchar can hold up her smartphone in a Senate hearing where Sundar Pichai is testifying and say, ‘Mr. Pichai, I have my Turkish VPN activated right now, and it appears that Turkish consumers are getting a better deal than Minnesota consumers.’”

What might that look like? Google hasn’t publicized any proposed remedies; Emily Clarke, a spokesperson, said the company is waiting for the full opinion to be released before it can figure out what its legal obligations are. Yelp argues that whoever wins the organic search results should also win the right to have its API power the OneBox results, on the theory that Google’s own algorithm has already deemed them the most relevant result. In other words, if a search right now leads to a Google Maps result in the OneBox, but the first link below that is from Yelp, then Yelp should get to populate the OneBox instead—meaning you would see Yelp reviews first, not Google reviews, when trying to figure out where to get dinner.

Such a change, if adopted widely, could dramatically reshape the flow of a great deal of internet traffic. As the analyst Rand Fishkin noted in 2019, more than 50 percent of Google searches end without the user clicking to another site. That’s partly because, as the Markup documented last year, Google’s own properties or “direct answers” make up well more than half of the first page a user sees when searching on mobile.

“If this jurisdiction compels them to behave in an interoperable and non-discriminatory way, that basically reverts the original mechanism of Google as kind of a turnstile,” said Lowe. “You get just a huge torrent of traffic to third party services.”

It’s easy to see why a company like Yelp wants a crack at top billing. The question is whether Turkey’s regulators will force Google to give it to them—and, if so, whether Google will go along or send Turkish users back to the original 10 blue links. Either way, the consequences will probably not stay confined to Turkey’s borders. US tech companies conquered the world. Now the world wants to conquer back.

This story originally appeared on wired.com.

https://arstechnica.com/?p=1796339

Apple and Google gave a boost to Russian President Vladimir Putin’s ruling party by removing a strategic voting app developed by activists who support the jailed opposition leader Alexei Navalny. The app, called “Navalny,” was kicked off the mobile app stores ahead of this weekend’s legislative election as Apple and Google caved to pressure from the Russian government.

“Removing the Navalny app from stores is a shameful act of political censorship. Russia’s authoritarian government and propaganda will be thrilled,” Ivan Zhdanov, who is director of the Navalny-founded Anti-Corruption Foundation and a politician in the Russia of the Future opposition party, wrote on Twitter. While candidates associated with Navalny are banned from the election, the Navalny app was designed to help voters coalesce around opposition candidates who are on the ballot.

As noted by NBC News, the now-removed “tactical voting app allows voters who do not want President [Vladimir] Putin’s ruling political party, United Russia, to win the election to organize around a single opposition candidate in each of the 225 electoral districts in an effort to boost the number of non-Kremlin-approved politicians in power.” Since mid-August, the Russian government has “threatened Apple and Google with fines if they didn’t remove Navalny’s tactical voting app from the App Store and Google Play store,” NBC News wrote.

Russia stepped up its pressure on the companies as the election drew nearer. “Google removed the app Friday morning after the Russian authorities issued a direct threat of criminal prosecution against the company’s staff in the country, naming specific individuals, according to a person familiar with the company’s decision,” The New York Times wrote. “The move comes one day after a Russian lawmaker raised the prospect of retribution against employees of the two technology companies, saying they would be punished.'”

In an apparently related move today, “Apple also disabled its Private Relay feature in Russia,” The Washington Post reported. “The feature conceals the user’s IP address and browsing data, offering protection against government surveillance online.” The feature was available in beta.

The Navalny app was removed just as voting began in the three-day election that runs from Friday to Sunday. Navalny’s team is apparently considering legal action against Apple and Google. We contacted Apple and Google about the app removal today and will update this article if we get any response.

Apple obeys government demands

Apple’s capitulation to the Russian government is likely concerning to anyone who opposes the company’s plan to have iPhones and other Apple devices scan user photos for child-sexual-abuse material (CSAM) before they’re uploaded to iCloud. Apple claimed it will refuse government demands to expand photo-scanning beyond CSAM. But Apple’s removal of the election app, when considered alongside previous concessions the company made to Russia and China, is a reminder that Apple has to comply with laws in the countries it operates in or risk losing access to those markets.

Apple has said it operates in countries where it disagrees with the laws in order to “remain engaged.” Apple’s “Commitment to Human Rights” document says, “We believe in the critical importance of an open society in which information flows freely, and we’re convinced the best way we can continue to promote openness is to remain engaged, even where we may disagree with a country’s laws,” NBC News reporter Olivia Solon pointed out today.

Apple initially said it would roll out the photo-scanning in the US this year and bring it to other countries later. More than 90 policy groups from the US and around the world urged Apple to drop the plan, predicting that governments will demand that Apple “scan photos not just for CSAM, but also for other images a government finds objectionable. Those images may be of human rights abuses, political protests, images companies have tagged as ‘terrorist’ or violent extremist content, or even unflattering images of the very politicians who will pressure the company to scan for them.” Implementing the photo-scanning system would lay a “foundation for censorship, surveillance and persecution on a global basis,” the groups said.

Amid the backlash, Apple said on September 3 that it will “take additional time over the coming months to collect input and make improvements before releasing these critically important child safety features.”

Voting app content “illegal in Russia”

Zhdanov posted a screenshot of Apple’s message informing Navalny app developers that the election app was removed. Apple said the Russian government’s censorship agency determined that the app “includes content that is illegal in Russia, which is not in compliance with the App Store Review Guidelines.” The message from Apple said:

Apps must comply with all legal requirements in any location where you make them available (if you’re not sure, check with a lawyer). We know this stuff is complicated, but it is your responsibility to understand and make sure your app conforms with all local laws, not just the guidelines below. And of course, apps that solicit, promote, or encourage criminal or clearly reckless behavior will be rejected.

We note that the Prosecutor’s Office of the Russian Federation and the Prosecutor’s Office of the City of Moscow have also determined that the app violates the legislation of the Russian Federation by enabling interference in elections.

While your app has been removed from the Russia App Store, it is still available in the App Stores for the other territories you selected in App Store Connect. The TestFlight version of this app will also be unavailable for external and internal testing in Russia and all public TestFlight links will no longer be functional.

Russia banned groups it labeled “extremist”

Apple’s message to the app developers included the request Apple received from the Russian government agency Roskomnadzor, the Federal Service for Supervision of Communications, Information Technology and Mass Media. Roskomnadzor told Apple that the Anti-Corruption Fund and Navalny’s “public movement” are “recognized as extremist within the country.”

“In accordance with Article 9 of the Federal Law of 25.07.2002 No. 114-FZ, ‘On Countering Extremist Activity,’ by the decision of the Moscow City Court dated 09.06.2021, these non-profit organizations were liquidated, and the activities of the public movement were prohibited,” Roskomnadzor told Apple. “At the moment, the Navalny application is being distributed through the App Store service, which is used to promote the activities and implement the activities of the aforementioned extremist organizations.”

With Navalny in prison and Russian authorities having prevented his backers and other opposition figures from getting on the ballot, the app was designed to help voters identify non-ruling party candidates.

“The idea, which Mr. Navalny calls smart voting, is to coalesce opposition-minded voters around one particular candidate running against United Russia in each of the country’s 225 electoral districts,” The New York Times wrote earlier this week. “That candidate could be a liberal, a nationalist or a Stalinist. Before Russians go to the polls, they can punch their address into the ‘Navalny’ smartphone app, which then responds with the names of the candidates they should vote for—whether or not voters agree with those persons’ views.”

As the BBC noted today, Putin’s United Russia Party is expected to win the election. “Although a total of 14 parties are taking part in the vote, many candidates seen as anti-Putin are barred from running, including anyone associated with Navalny’s opposition movement. Some prominent Kremlin opponents have been forced to leave Russia,” the BBC wrote.

“Even in Russia, voting is not criminal behavior”

Tech Legal Counsel Natalia Krapiva of digital-rights advocacy group Access Now wrote on Twitter that the app “helped Russians that disagree with Putin find candidates to vote for” and is the “very definition of democratic process.”

“For once, Putin was afraid too… Russia has tried everything to get the app pulled. A spurious trademark lawsuit, legal threats. @Google and @Apple knew exactly what was going on. And, until this morning, they resisted,” Krapiva wrote.

“Worse: after pulling the real voting guide app, @Apple is keeping impostor apps,” she added. “Russians headed to the polls are now unwittingly installing apps that may put them in immediate danger.”

Krapiva pointed out that Apple’s correspondence to the app developers warned them that apps must not promote “criminal” behavior. “@Apple, I can’t believe I need to say this but even in Russia, voting is not criminal behavior,” Krapiva wrote. Apple and Google “owe the Russian people an explanation,” she wrote.

https://arstechnica.com/?p=1796254