In the wake of the 2016 election, Facebook knew it had a problem. Pages and fake accounts created by the Kremlin-backed Internet Research Agency had spread through the social network and drawn massive engagement from real users. Facebook knew it had to get things under control.

But years later, Facebook’s own internal research teams revealed that troll farms were still reaching massive audiences, even if they didn’t have large direct followings. The company’s own algorithms pushed the troll content onto users who had not expressed interest in the pages, expanding the trolls’ reach exponentially. A report detailing the research was leaked to MIT Technology Review by a former employee.

When the report was published in 2019, troll farms were reaching 100 million Americans and 360 million people worldwide every week. In any given month, Facebook was showing troll farm posts to 140 million Americans. Most of the users never followed any of the pages. Rather, Facebook’s content-recommendation algorithms had forced the content on over 100 million Americans weekly. “A big majority of their ability to reach our users comes from the structure of our platform and our ranking algorithms rather than user choice,” the report said.

The troll farms appeared to single out users in the US. While globally more people saw the content by raw numbers—360 million every week by Facebook’s own accounting—troll farms were reaching over 40 percent of all Americans.

The report, authored by Jeff Allen, a former data scientist at Facebook, reveals that the company’s prioritization of engagement led to the problem. Facebook, he said, knows very little about content producers. Who posted something wasn’t being considered in the News Feed algorithm.

“It’s a lot of extremely fancy collaborative filtering algorithms but all based around engagement,” Allen wrote. “When the content producers that win that system are exploiting communities on our platform rather than building and supporting them, it becomes clear that the ranking system does not reflect our company values. So much so that it is actually working against us.”

Foreign influencers

Many of the pages are run from countries on the Balkan peninsula and target foreign audiences with a primary focus on Americans, the report says.

The popularity and reach of the troll farms led Allen to believe that Russian Internet Research Agency operatives were likely able to exploit the same techniques or use the same pages to reach American users. “If the Troll Farms are reaching 30M US users with content targeted to African Americans, we should not at all be surprised if we discover the IRA also currently has large audiences there,” Allen wrote.

What’s more, the troll farms were able to slip their content into Instant Articles and Ad Breaks, two Facebook programs that give partners a cut from sales of advertisements that run alongside page content. “In Instant Articles, there was a period when perhaps as much as 60% of Instant article reads were taking place on scraped content, which is the Troll Farms article writing method of choice,” Allen said. Facebook had been inadvertently paying the troll farms.

“This post was from a departing employee in 2019,” Facebook spokesperson Joe Osborne told Ars. “Even at the time it was posted, we had already been investigating these topics—and since that time—we have stood up teams, developed new policies and collaborated with industry peers to address these networks. We’ve taken aggressive enforcement actions against these kinds of foreign and domestic inauthentic groups and have shared the results publicly on a quarterly basis.”

Ars has sent Facebook additional questions, and we’ll update this story if we get a response.

Exploited communities

Users who saw troll farm content tended to fall into two groups, Allen wrote. “One camp doesn’t realize the Pages are run by inauthentic actors who are exploiting their communities. They tend to love these Pages. They like how entertaining the posts are and how they reaffirm their already-held beliefs,” he wrote. “The other camp does realize the Pages are run by inauthentic actors. They hate the ever-loving shit out of these Pages. They hate these Pages with a passion that even I find impossible to match.”

The latter group was actively telling Facebook about the problem. “Our users are literally trying to tell us that they feel exploited by these Pages,” Allen said. 

By way of example, Allen cited one user who discovered a troll farm page that was targeted toward American Indians. The troll group stole art and sold it reprinted on T-shirts that were frequently never shipped to customers, the user said. “This whole group is a fraud ring,” the user wrote.

The troll farms highlighted in the report primarily targeted four different groups: American Indians, Black Americans, Christian Americans, and American women. At the time it was written in October 2019, the report says that for many of those groups, a majority of the top pages were run by troll farms, including all 15 top pages targeting Christian Americans, 10 of the top 15 targeting Black Americans, and four of the top 15 targeting American Indians. When MIT Technology Review published its story, five of the troll groups were still active. Three targeted Black Americans, one targeted Christian Americans, and one targeted American Indians.

Much of the content these groups posted, while frequently stolen, apparently did not otherwise violate Facebook’s content rules. Still, that didn’t mean it was harmless, Allen said. “The bottom line is, regardless of if there is or is not IP violation taking place, posting strictly unoriginal content violates our policies and exposes our communities to exploitation,” Allen explained.

Simple fixes

Allen believed the problem could be fixed relatively easily by incorporating “Graph Authority,” a way to rank users and pages similar to Google’s PageRank, into the News Feed algorithm. “Adding even just some easy features like Graph Authority and pulling the dial back from pure engagement-based features would likely pay off a ton in both the integrity space and… likely in engagement as well,” he wrote.

Allen left Facebook shortly after writing the document, MIT Technology Review reports, in part because the company “effectively ignored” his research, a source said.

https://arstechnica.com/?p=1796217

Telegram has exploded as a hub for cybercriminals looking to buy, sell, and share stolen data and hacking tools, new research shows, as the messaging app emerges as an alternative to the dark web.

An investigation by cyber intelligence group Cyberint, together with the Financial Times, found a ballooning network of hackers sharing data leaks on the popular messaging platform, sometimes in channels with tens of thousands of subscribers, lured by its ease of use and light-touch moderation.

In many cases, the content resembled that of the marketplaces found on the dark web, a group of hidden websites that are popular among hackers and accessed using specific anonymizing software.

“We have recently been witnessing a 100 per cent-plus rise in Telegram usage by cybercriminals,” said Tal Samra, cyber threat analyst at Cyberint.

“Its encrypted messaging service is increasingly popular among threat actors conducting fraudulent activity and selling stolen data… as it is more convenient to use than the dark web.”

The rise in nefarious activity comes as users flocked to the encrypted chat app earlier this year after changes to the privacy policy of Facebook-owned rival WhatsApp prompted many to seek out alternatives.

Launched in 2013, Telegram allows users to broadcast messages to a following via “channels” or create public and private groups that are simple for others to access. Users can also send and receive large data files, including text and zip files, directly via the app.

The platform said it has more than 500 million active users and topped 1 billion downloads in August, according to data from SensorTower.

But its use by the cyber criminal underworld could increase pressure on the Dubai-headquartered platform to bolster its content moderation as it plans a future initial public offering and explores introducing advertising to its service.

According to Cyberint, the number of mentions in Telegram of “Email:pass” and “Combo”—hacker parlance used to indicate that stolen email and passwords lists are being shared—rose fourfold over the past year, to nearly 3,400.

In one public Telegram channel called “combolist,” which had more than 47,000 subscribers, hackers sell or simply circulate large data dumps of hundreds of thousands of leaked usernames and passwords.

A post titled “Combo List Gaming HQ” offered 300,000 emails and passwords that it claimed were useful for hacking video game platforms such as Minecraft, Origin, or Uplay. Another purported to have 600,000 logins for users of the services of Russian Internet group Yandex, others for Google and Yahoo.

Telegram removed the channel on Thursday after it was contacted by the Financial Times for comment.

Yet email password leaks account for only a fraction of the worrisome activity on the Telegram marketplace. Other types of data traded include financial data such as credit card information, copies of passports and credentials for bank accounts and sites such as Netflix, the research found. Online criminals also share malicious software, exploits and hacking guides via the app, Cyberint said.

Meanwhile, links to Telegram groups or channels shared inside forums on the dark web jumped to more than 1 million in 2021, from 172,035 the previous year, as hackers increasingly direct users to the platform as an easier-to-use alternative or parallel information center.

The research follows a separate report earlier this year by vpnMentor, which found data dumps circulating on Telegram from previous hacks and data leaks of companies including Facebook, marketing software provider Click.org, and dating site Meet Mindful, among others.

“In general, it appears that most data leaks and hacks are only shared on Telegram after being sold on the dark web—or the hacker failed to find a buyer and decided to share the information publicly and move on,” vpnMentor said.

Still, it dubbed the trend “a serious escalation in the ongoing surge of cyber crime,” noting that some users in these groups appeared less tech savvy than a typical dark web user.

Telegram said it was unable to verify the vpnMentor findings because the researchers had not shared details identifying which channels these alleged leaks were in.

Samra said the transition for cybercriminals from the dark web to Telegram was taking place in part because of the anonymity afforded by encryption—but noted that many of these groups were also public.

Telegram is also more accessible, provides better functionality, and is generally less likely to be tracked by law enforcement when compared to dark web forums, he added.

“In some cases, it’s easier to find buyers on Telegram rather than a forum because everything is smoother and quicker. Access is easier… and data can be shared much more openly.”

Hackers are less inclined to use WhatsApp both for privacy reasons and because it displays users’ numbers in group chats, unlike Telegram, Cyberint said. Encrypted app Signal remains smaller and tends to be used for more general messaging among people who know each other rather than forum-style groups, it added.

Telegram has long taken a more lax approach to content moderation than larger social media apps such as Facebook and Twitter, attracting scrutiny for allowing hate groups and conspiracy theories to flourish. In January, it began shutting down public extremist and white supremacist groups—for the first time—in the wake of the Capitol riots amid concerns it was being used to promote violence.

The Cyberint research—particularly the uncovering of public, searchable groups for cybercriminals—raises further questions about Telegram’s content moderation policies and enforcement at a time when chief executive Pavel Durov has said the company is preparing to sell advertisements in public Telegram channels.

It also comes as the company prepares to head for public markets after raising more than $1 billion through bond sales in March to investors including to Mubadala Investment Company, the Gulf emirate’s large sovereign wealth fund, and Abu Dhabi Catalyst Partners, a joint venture between Mubadala and the $4 billion New York hedge fund Falcon Edge Capital.

Telegram said in a statement that it “has a policy for removing personal data shared without consent.” It added that each day, its “ever growing force of professional moderators” removes more than 10,000 public communities for terms of service violations following user reports.

© 2021 The Financial Times Ltd. All rights reserved Not to be redistributed, copied, or modified in any way.

https://arstechnica.com/?p=1796172

The Department of Justice is fighting to strip the billionaire Sackler family of the sweeping legal immunity granted as part of a controversial $4.5 billion opioid settlement.

The department filed a motion late Wednesday to block the implementation of the settlement until appeals can be heard in a higher court. Attorneys for the department argued that some aspects of the deal could go into effect quickly, complicating the appeal, according to NPR. Along with the DOJ, Connecticut, Maryland, the District of Columbia, and Washington state are also preparing to fight the settlement.

The Justice Department also requested an expedited hearing within the next two weeks.

William Harrington, who serves as US trustee for the Justice Department, said in filings Wednesday that Federal Bankruptcy Judge Robert Drain was wrong to approve the settlement on September 1 and that the decision would likely be overturned.

The settlement essentially dissolves Purdue Pharma, which was owned and largely run by the Sacklers. The company aggressively and deceptively marketed OxyContin beginning the 1990s and is largely seen as sparking the devastating epidemic of opioid addiction and overdoses that has killed nearly 500,000 people in the US over the last two decades. Purdue pleaded guilty twice for wrongdoing in its marketing of OxyContin in that time. The settlement put to rest thousands of opioid-related lawsuits against Purdue, which had declared bankruptcy under the crushing litigation.

The Sacklers were directly involved in Purdue’s opioid business and, by their own account, pocketed more than $10 billion from opioid sales. But the family has repeatedly claimed no wrongdoing and said it acted ethically.

Undone deal

Still, as part of the settlement, the Sacklers agreed to never again manufacture opioids and provide $4.325 billion to fund opioid addiction prevention, treatment, and recovery programs. They also agreed to hand over control of family foundations valued at no less than $175 million.

But that $4.5 billion agreement came with a big string attached: the Sacklers demanded that they be granted legal immunity from future opioid-related claims. Such liability releases can be granted in bankruptcy cases, but the Sacklers themselves did not file for bankruptcy.

Judge Drain, who himself called the settlement a “bitter result,” argued in his approval of the deal that it was the best way to get any money out of the Sacklers. “I believe that at least some of the Sackler parties also have liability for those [opioid] claims… I would have expected a higher settlement,” he said. But “without the releases, the plan would unravel.”

In filings Wednesday, the DOJ trustee Harrington argued that the releases are unconstitutional because they deprive people from making legal claims—a form of property—against the Sacklers, according to The Wall Street Journal.

“The Sackler family’s attempt to hold [Purdue’s] reorganization hostage unless the non-debtor releases are imposed does not justify taking third parties’ property…without their consent, adequate notice, or any opportunity to be heard,” Harrington said.

https://arstechnica.com/?p=1796036

A man who operated a dark web service that hosted millions of child-sexual-abuse images was sentenced to 27 years in federal prison for conspiracy to advertise child pornography, the US Department of Justice announced today. Eric Eoin Marques, a 36-year-old dual national of the US and Ireland, was also sentenced to “a lifetime of supervised release” after his prison time is over.

Marques will get credit for time served from July 2013 to the present, a sentencing document says. He was also ordered to forfeit over $154,000.

During a 2013 bail hearing in Dublin, FBI Special Agent Brooke Donahue “agreed that he had described Marques as ‘the largest facilitator of child porn on the planet’ and added ‘that remains true to this day,'” according to an Irish Examiner article in September 2013. An Irish court record provides a slightly different wording of Donahue’s quote, describing Marques as “the largest facilitator of child pornography websites on the planet.” Today’s DOJ announcement said that “Marques was one of the largest facilitators of child pornography in the world.”

“Sadistic abuse of infants and toddlers”

From 2008 to 2013, “Marques operated a free anonymous hosting service located on the ‘dark web,'” and Marques’ service “hosted websites that allowed users to view and share images documenting the sexual abuse of children, including the abuse of prepubescent minors, violent sexual abuse, and bestiality,” the DOJ said in February 2020 after Marques pleaded guilty. An “investigation revealed that the hosting service contained over 8.5 million images of child exploitation material and [that] over 1.97 million of these images and/or videos involved victims that were not known by law enforcement.”

Marques’ “hosting service contained over 200 child exploitation websites,” including one website where “nearly 1.4 million files were uploaded and accessible by individuals who visited that hidden service,” the DOJ has said. Many of the images found by investigators “involved sadistic abuse of infants and toddlers.”

International investigation

In August 2013, the US filed a criminal complaint against Marques in US District Court for the District of Maryland. Ars covered the case in 2013, noting that Marques was “accused of running Freedom Hosting, a major hidden services provider on the Tor network that was notorious for hosting child porn sites.”

“This is an egregious case where one individual hosted and helped others to share millions of horrific images and videos of the abuse of children, including more than a million not previously known to law enforcement, and attempted to keep the abuse hidden on the dark web,” acting US Attorney Jonathan Lenzner said in today’s DOJ announcement.

A dozen countries and Europol were involved in the investigation, which went beyond Marques’ activities, the DOJ said:

Through this investigation, more than 200 child sexual exploitation websites were taken offline (along with hundreds of other sites sponsoring or facilitating criminal activity); the activities of tens of thousands of online child pornographers were disrupted; over four million images and videos of child sexual abuse were seized (including more than 100 previously unknown series of child abuse images and new images from more than 50 existing series); and dozens of offenders were identified and prosecuted throughout the world.

Marques needs permission to use Internet

Marques was jailed in Ireland starting in 2013 and was extradited to the US in March 2019. Marques pleaded guilty in February 2020 to conspiracy to advertise child pornography. The US dropped charges for conspiracy to distribute child pornography, advertising child pornography, and distribution of child pornography.

The terms of Marques’ supervised release will let him live in Ireland after he completes the prison term in the US. He will not be allowed to access the Internet “except for reasons approved in advance by the probation officer” and must allow the probation officer to install monitoring software on any computer he uses. The definition of “computer” under the US Computer Fraud and Abuse Act is pretty broad, so the monitoring-software condition would presumably cover smartphones and tablets in addition to PCs.

Other supervised release conditions include having no contact with minors and no possession of pornographic materials. Marques will be required to register as a sex offender, undergo sex-offender assessment and treatment, and submit to polygraph tests to ensure compliance with the various conditions.

Listing image by Getty Images | Niall Carson | PA Images

https://arstechnica.com/?p=1795953

A federal judge yesterday declared a mistrial in the case against Backpage’s founders, ruling that US prosecutors unfairly tainted the jury by focusing too heavily on claims of child sex trafficking in a trial that involved zero charges of child sex trafficking. A new trial will be held.

“‘The government, as prosecutors, are held to a higher standard,’ said Judge Susan Brnovich from the bench as court opened for what was expected to be the eighth day of the trial. ‘Their goal is not to win at any costs, but their goal is to win by the rules,'” according to an Arizona Republic article.

The case against Backpage founders Michael Lacey and James Larkin, plus five Backpage executives and managers, is in US District Court for the District of Arizona. The actual charges are for conspiracy, facilitating prostitution, and money laundering. An order confirming the declaration of mistrial was filed, but Brnovich explained her reasoning orally.

US law enforcement agencies seized Backpage.com in April 2018, with the Justice Department calling it “the Internet’s leading forum for prostitution ads, including ads depicting the prostitution of children.”

Prosecutors persisted despite warnings

“I, at the beginning of this, gave the government some leeway because child sex trafficking [and] sex trafficking are forms of prostitution,” Brnovich said, according to a Reason article. “Yet in the [government’s] opening and with every witness thereafter, it seems, the government has abused that leeway.” The defendants will be punished if the government proves they “knowingly facilitated prostitution… but it should be done correctly,” she said.

After the prosecution’s opening statement came “close to causing [a] mistrial,” the government agreed to minimize its focus on child sex trafficking, the judge reportedly said. Brnovich warned prosecutors to keep testimony focused on the charges in the 100-count indictment and “said she wanted to tamp down on discussions of child sex trafficking and murders of people who had advertised on Backpage, knowing such testimony would inflame the jury,” the Arizona Republic wrote. But one prosecution witness, a physician who works with sex trafficking victims, “emphasized child sex trafficking above everything else,” Brnovich said.

“Brnovich said such testimony was allowable only if it involved evidence that Backpage executives and employees knew about it,” according to the Arizona Republic. The article continued:

Similarly, Brnovich said that testimony given by Jessika Svendgard, who discussed being sold as a teen on Backpage, went beyond the legal boundaries she set in place. Brnovich said that despite her ruling that prosecutors stay away from day-in-the-life style testimony from any prostitutes or trafficking victims, the government’s attorneys succeeded in getting Svendgard to discuss exactly that.

Svendgard told jurors, at times through tears, about being sold on Backpage by a series of pimps. “I would be raped for money,” she said. Brnovich said the use of that word “raises a whole new emotional response from people.”

Brnovich said she doesn’t view the prosecutors’ mistakes “as intentional misconduct,” but “the cumulative effect of all of that is something that I can’t overlook and won’t overlook.” The judge scheduled an October 5 status hearing to discuss a new trial.

Defendants sought acquittal

Yesterday’s ruling came in response to a defendants’ motion for acquittal or, at minimum, mistrial. The defendants contended that the “government’s opening argument was a parade of horribles about human trafficking destroying the lives of trafficked women and children, with barely any mention of charged counts and zero linkage of any defendant to any charged count.” The government “absolutely ignored the court’s admonitions” to focus on the charges, which center on “whether each individual defendant had specific knowledge of each charged ad and specifically intended to promote a business of prostitution by that ad,” the motion said.

“During two hours of improper, inflammatory argument, the government failed to allege that any defendant had knowledge of a single ad charged in the indictment, much less set forth any facts that could establish the specific intent necessary to convict on any count,” the motion also said.

The US government’s response said that the court “issued a pretrial ruling addressing this issue, finding that ‘[s]ex trafficking and child sex trafficking are, by definition, both forms of prostitution,’ and ‘[e]vidence that tends to prove that defendants were aware that Backpage.com was being used to facilitate sex trafficking and child sex trafficking are extremely probative to show notice to defendants that the website was being used for illegal purposes’—including facilitation of prostitution.”

“Throughout the last three years of intense pretrial litigation, defendants never seriously addressed any evidence concerning their prostitution-marketing strategies,” the US argued. “In the instant motion, defendants studiously avoid discussing this evidence. Rather, defendants continue to take the exceedingly narrow view that they can only be liable if they had specific knowledge of each individual ad.”

https://arstechnica.com/?p=1795520

New York will ban the sale of fossil fuel vehicles starting in 2035 and require all new cars to produce zero emissions. The new law, signed by Democratic Gov. Kathy Hochul last week, will help slash the state’s carbon pollution by 35 percent. It would put New York well on its way to achieving its statewide carbon reduction goals of 85 percent below 1990 levels.

While the sunset date is in line with other plans from the state government, hitting the goal will still require significant planning and coordination. Though electric vehicles aren’t uncommon in New York, the state is effectively starting from zero—around 1 percent of new vehicles sold in the Empire State are fully electric.

The new law doesn’t stop at passenger vehicles. It also requires zero emissions for off-road vehicles and equipment by 2035 and for medium- and heavy-duty vehicles by 2045. There’s some wiggle room with these mandates should batteries or fuel cells for large trucks or construction equipment lag significantly. The law says zero emissions will only be required “where feasible.”

With 14 years before the mandate kicks in, there’s plenty of time to work out the kinks. Still, the state legislature didn’t want to leave things to chance. The law requires various state agencies to coordinate to produce a market-development strategy by the end of next year. The strategy will also have to consider how to support the market for both new and used EVs, which should help address some concerns about affordability.

New York will most likely have the new vehicle market on its side. BloombergNEF forecasts that battery electric vehicles will reach price parity with fossil fuel vehicles in 2022 for passenger cars and in 2024 for trucks and SUVs. (Fuel cell vehicles would also qualify, but so far, those sales amount to a rounding error.)

Building networks

Convincing the public to buy EVs requires more than just incentives, of course. For many people, charging remains a hurdle in either a physical or psychological sense (or both). The state will have to roll out a significant fast-charging network to facilitate long-distance travel, and it will have to encourage cities to install slower, level-2 charging infrastructure to allow renters and condo dwellers to charge. Such a network would include the usual places, like grocery stores and shopping malls, but also streets and parking garages.

Curbside charging would be especially important in New York City, where on-street parking is the rule rather than the exception. By 2050, the city predicts it will need 800,000 level-2 chargers and 60,000 fast chargers. And given that the Big Apple is home to over 40 percent of the state’s population, solving that problem is likely on the top of state agencies’ lists.

New York City has already begun experimenting with curbside charging, installing 120 chargers that EV owners can pay to use by the hour. The initial installations were sited based on projected demand, community input, and geographic diversity. Business owners can request that a charger be installed in front of their building, too. Parking spaces in front of the EV service equipment are reserved for actively charging vehicles. Cars not charging can be ticketed.

Another solution would be to piggyback EV chargers on streetlight poles. Los Angeles has already installed over 430 of them scattered throughout the city, and London has converted over 1,300 lampposts to add EV charging. Kansas City is trialing the setup, too, with plans to install 30–60 by the end of the year.

Second statewide mandate

New York is the latest state to announce a sunset date for new fossil fuel vehicle sales. Last September, California Gov. Gavin Newsom (also a Democrat) issued an executive order directing the California Air Resources Board, better known as CARB, to develop regulations to mandate zero emissions for all new passenger cars and trucks by 2035. The order was issued under California’s unique authority under the Clean Air Act, which gives the Golden State the power to make laws and regulations stricter than the federal code. Massachusetts joined California last year in announcing a phaseout date of 2035.

Washington state attempted to pass a law earlier this year with a sunset date of 2030. The law made it through the legislature but was vetoed by Democratic Gov. Jay Inslee, who was concerned that the sunset date was tied to the implementation of a road-usage charge. The zero-emissions vehicle mandate, he said, was too important to be tied to other initiatives.

New York’s law makes it the first to be passed by a state legislature and signed by the governor. By going through the traditional legislative process, it may establish a template that other states can follow.

https://arstechnica.com/?p=1795160

President Joe Biden’s failure to nominate a fifth Federal Communications Commission member has forced Democrats to work with a 2-2 deadlock instead of the 3-2 majority the president’s party typically enjoys at the FCC. But things could get worse for Democrats starting in January. If Biden doesn’t make his choice quickly enough to get Senate confirmation by the end of this year, Republicans could get a 2-1 FCC majority despite Democrats controlling both the White House and Senate.

That possibility can be easily averted if Biden and the Senate spring into action, but it’s closer to becoming a reality than anyone expected when Biden became president. The reason is that acting FCC Chairwoman Jessica Rosenworcel’s term expired in mid-2020. US law allows commissioners on lapsed terms to stay until “the expiration of the session of Congress that begins after the expiration of the fixed term,” which means she can stay until the beginning of January 2022.

To ensure a 3-2 Democratic majority in January, Biden has to nominate a third Democrat, renominate Rosenworcel or nominate a replacement for Rosenworcel, and hope that the Senate confirms both nominations in time. As president, Biden can promote any commissioner to chair, but the Senate decides whether to confirm each newly nominated commissioner. That process usually takes a few months or longer. Tom Wheeler was confirmed as FCC chairman in October 2013, six months after his nomination.

“If a GOP majority happens…”

With three and a half months left in the year, it would still be surprising if Republicans gain a 2-1 majority at the FCC. But it’s also surprising that Biden waited so long that a Republican majority became a real possibility—particularly given Biden’s promises to lower Internet prices, end hidden broadband fees, restore net neutrality rules, and promote the deployment of municipal networks.

“Is it a real possibility that there’s a 2-1 Republican majority? The further we get in the year, the more that becomes a possibility,” Chris Lewis, president and CEO of consumer-advocacy group Public Knowledge, told Ars. “The rules about appointments and nominations are clear. Acting Chair Rosenworcel is almost out of time, and we’ve yet to see names put forward by the president. If a GOP majority happens, it will be because the Biden administration and the Senate failed to act in time.”

Despite Biden nominating a new commissioner for the Federal Trade Commission yesterday, advocacy groups that closely follow the FCC still don’t know when the FCC pick will be announced by the White House. Lewis told Ars today that commission observers are “still in the dark. I know there’s a lot of chatter about how the infrastructure package plays into when Biden may announce. That makes sense to me. But otherwise, we don’t know.”

Biden has taken longer to pick a permanent FCC leader “than any president since Jimmy Carter in 1977,” The Washington Post recently noted. But Carter announced his pick on September 12 of that year, so Biden has now taken even longer. Biden also hasn’t chosen a permanent leader for the Commerce Department’s National Telecommunications and Information Administration, and the delay is the “longest ever since the agency’s founding in 1978,” the Post wrote.

Potential Biden pick was opposed in Senate

Blair Levin has been following and involved in FCC developments for decades. He was FCC chief of staff for Chairman Reed Hundt in the 1990s, he was the official who oversaw the development of the FCC’s National Broadband Plan released in 2010, and he’s now a senior fellow at the Brookings Institution and a policy analyst for New Street Research. In July, Levin wrote that the potential nomination of longtime consumer advocate Gigi Sohn “led to enough Senatorial opposition that she is no longer at the top of the rankings, leaving the situation murkier than ever.” Levin further noted that while “interim Chair Rosenworcel continues to have significant Senate support, her inability to obtain the nomination after more than six months suggests to us that there is some internal White House opposition. But there is no clear front-runner for replacing her.”

Levin told Ars that he has no solid information on who Biden will pick or when he’ll make an announcement. Like Lewis, he says that Biden’s delay has lasted so long that it is now possible for the GOP to gain an FCC majority in January. “Yes, there is a real possibility that the Democrats never gain a majority and even find themselves in the minority,” Levin told us.

Free Press VP of Policy and General Counsel Matt Wood said that Biden is cutting it closer “than anyone would like” but that he still thinks it’s likely Democrats will avert the worst-case scenario. Wood pointed out that in December 2020, the Senate’s then-Republican majority fast-tracked the confirmation of Trump nominee Nathan Simington in order to create the FCC’s 2-2 deadlock. The confirmation was almost three months after then-President Donald Trump made the nomination, which isn’t atypical, but Republicans sped up the process after Biden won the election.

“Unfortunately, yes, [a 2-1 GOP majority is] possible. I still think it’s unlikely,” Wood told Ars today. “It wasn’t a great moment in American governance, but the Simington timetable last year shows that these things can move more quickly than they typically do.”

Biden and Senate leadership haven’t agreed

Which candidate is at the top of Biden’s list is unknown, and he’s apparently waiting until he can agree with Senate Democratic leaders on the makeup of the expected 3-2 Democratic majority. Ideally, Biden would nominate two Democrats simultaneously, and the Senate would pair the nominations and fast-track their approvals.

Democrats could already have an FCC majority if Biden had prioritized a nomination and settled on a choice amenable to senators by the time of his inauguration in January or even by March, April, or May. A September 2020 article by Protocol—two months before Biden beat Trump in the election—listed 14 potential nominees with experience at the FCC or in the telecom industry.

“There’s a long list of Democrats with FCC experience, and a number of them are people of color, which is sure to be a factor for Biden if he’s elected; several insiders said that being a white male would be just short of disqualifying for the top slot at the FCC under a Biden administration,” Protocol wrote in that article just over a year ago, noting that there was already plenty of speculation about Biden’s pick.

FCC takes back seat in Biden era

The deadlocked FCC is playing a reduced role in the Biden administration. By contrast, the president has kept the Federal Trade Commission fully staffed, and the choice of Lina Khan as FTC chair promises to turn that agency into a more aggressive antitrust regulator. But the FTC is focusing on Big Tech and has to oversee competition in many industries. The FTC lacks the FCC’s telecom expertise and will not spend nearly as much time or resources on protecting broadband consumers as a fully staffed FCC would.

Even on broadband, the FCC is apparently losing some of its sway. The pending Infrastructure Investment and Jobs Act, a result of Biden’s bipartisan deal with Congress, would spend tens of billions on broadband deployment. But grants from the legislation’s $42.45 billion Broadband Equity, Access, and Deployment program would be distributed by the National Telecommunications and Information Administration instead of the FCC.

This may be due to former FCC Chairman Ajit Pai’s mismanagement of a $9 billion rural-broadband fund, which has forced Rosenworcel to “clean up” mistakes that would send funding “to parking lots and well-served urban areas.” Levin recently said that the rural-fund screwup created a feeling that Congress “can’t trust the FCC,” according to a Telecompetitor article.

“Tremendous missed opportunity”

The FCC has some important things to do even with a 2-2 deadlock, like distributing new emergency broadband subsidies that Congress created in response to the pandemic. Controversial tasks like restoring net neutrality rules or the various other regulations and consumer protections eliminated by the Trump-era FCC would require a Democratic majority.

Biden recently urged the FCC to take action against the broadband industry’s misleading advertised prices and high termination fees, to end exclusive deals between ISPs and landlords that limit tenants’ choices, and generally to reverse Pai-led FCC decisions that benefited Internet service providers instead of Internet users. But Biden’s inaction is the main thing preventing the FCC from accomplishing the White House’s broadband goals. Biden may have faced Senate resistance behind the scenes, but he could have chosen to send nominations to the Senate even without a guarantee that they would be approved.

“Failing to seat a full commission this year could be a tremendous missed opportunity for the Biden administration to move forward on the goals it has laid out to fully close the digital divide and protect an open Internet,” Lewis told Ars. “This work takes time, and oversight of the FCC from a Congress in reelection mode in 2022, or with a new makeup in 2023 could disrupt that important work.”

FCC can’t vote on anything remotely controversial

Wood noted that the FCC often has party-line votes on topics that are controversial only in the Beltway—like municipal broadband networks, which are supported by both Democratic and Republican voters despite Republicans in Congress trying to ban the public networks. Similarly, Pai led a 3-2 vote to repeal net neutrality rules even though most Republican voters supported the regulations.

With a 2-2 deadlock in which both Republicans generally oppose Democratic priorities, Wood said that the FCC “can’t really move ahead on anything that is the least bit controversial within the Beltway,” even if those policies are supported by large majorities of Americans.

https://arstechnica.com/?p=1795130

Facebook had a problem on its hands. People were making posts that got caught in the company’s automated moderation system or were taken down by its human moderators. The problem wasn’t that the moderators, human or otherwise, were wrong to take down the posts. No, the problem was that the people behind the posts were famous or noteworthy, and the company didn’t want a PR mess on its hands.

So Facebook came up with a program called XCheck, or cross check, which in many instances became a de facto whitelist. Over the years, XCheck has allowed celebrities, politicians, athletes, activists, journalists, and even the owners of “animal influencers” like “Doug the Pug” to post whatever they want, with few to no consequences for violating the company’s rules.

“For a select few members of our community, we are not enforcing our policies and standards,” reads an internal Facebook report published as part of a Wall Street Journal investigation. “Unlike the rest of our community, these people can violate our standards without any consequences.”

“Few” must be a relative term at Facebook, as at least 5.8 million people were enrolled in the program as of last year, many of them with significant followings. That means a large number of influential people are allowed to post largely unchecked on Facebook and Instagram.

“PR fires”

The social media giant acknowledged that the program existed for politicians in 2019, but details of XCheck’s extent and mismanagement are new. Facebook is apparently aware of XCheck’s problems, based on excerpts from the report, but the company has struggled to fix the issues. Before making any changes to XCheck, the program’s product manager wrote in a report, “we have to balance that with business risk.”

XCheck was initially designed to keep “PR fires” to a minimum. When typical users post something that’s flagged by moderation algorithms or taken down by human moderators, they can file a report with Facebook. If they don’t win their appeal, there’s not much else they can do.

But when prominent users are moderated, they can air their grievances with their followers, creating a potential public relations headache. If the users are politicians, they might call for increased regulation of the platform. So rather than treat these elite users the same as everyone else, Facebook reportedly allows them to post whatever they like. If a post is flagged by an algorithm, it’s sent to a different set of moderators, which the WSJ says are “better-trained, full-time employees,” for review.

Yet as the list of users has grown, XCheck moderation teams apparently haven’t been able to keep pace. “We currently review less than 10% of XChecked content,” one document stated. It’s gotten so bad that elite users have been reportedly able to publish everything from disinformation to threats of violence, revenge porn, and more, allowing posts that violate Facebook’s policies to nonetheless appear on the feeds of thousands to millions of people.

VIP treatment

Even in cases where the content is ultimately removed, Facebook has treated VIP users differently from others. In the documents reviewed by the WSJ, the case of Neymar, the Brazilian soccer player, stands out. In 2019, he posted a video to his Facebook and Instagram accounts that contained nude photos of a woman who had accused him of rape. He claimed that she was extorting him.

For normal users, posting “nonconsensual intimate imagery” triggers a straightforward response—it is immediately deleted, and the person’s account is deactivated. Instead, Neymar’s video remained up for more than a day. Regular moderators couldn’t touch it, and by the time it was taken down by the XCheck team, 56 million people had seen it. The video was reposted 6,000 times, and many commenters bullied and harassed the woman. Neymar denied the rape allegations, and no charges were filed. But despite posting what Facebook itself called “revenge porn,” Neymar’s account was not deleted.

“After escalating the case to leadership, we decided to leave Neymar’s accounts active, a departure from our usual ‘one strike’ profile disable policy,” a Facebook review said.

“Tradeoffs”

“We know our enforcement is not perfect, and there are tradeoffs between speed and accuracy,” Facebook spokesperson Andy Stone said in a Twitter thread. “We have new teams, new resources, and an overhaul of the process that is an existing work-stream at Facebook.”

Some of the documents reviewed by the WSJ came from a person seeking federal whistleblower protection. The person reportedly turned over the same documents to the Security and Exchange Commission and to Congress.

As recently as March, users were being added to the XCheck lists, expanding a program that had already grown too unwieldy for Facebook to adequately manage. The company has reportedly set a goal to enforce “high severity” rule violations by the first half of this year. In the meantime, Facebook plans to assume “good intent” on the part of high-profile users in the program and take an approach of “innocent until proven guilty,” a product manager on Facebook’s Mistakes Prevention Team wrote.

“We do not have systems built out to do that extra diligence for all integrity actions that can occur for a VIP,” she wrote.

https://arstechnica.com/?p=1794212

President Joe Biden will reportedly nominate Georgetown law professor and privacy researcher Alvaro Bedoya to the Federal Trade Commission. Bedoya is the founding director of Georgetown Law’s Center on Privacy & Technology, where he has focused heavily on facial recognition and other forms of surveillance.

Bedoya co-authored a 2016 report about “unregulated police face recognition in America” after a “year-long investigation that revealed that most American adults are enrolled in a police face recognition network and that vendor companies were doing little to address the race and gender bias endemic to face scanning software,” according to Bedoya’s bio on the Georgetown Law website. The investigation led to Congressional hearings as well as “a slate of laws reining in the technology across the country, and the first-ever comprehensive bias audit of the technology by the National Institute of Standards & Technology.”

Before starting the privacy center at Georgetown, Bedoya was chief counsel for the US Senate Judiciary Subcommittee on Privacy, Technology, and the Law. Bedoya’s nomination hasn’t been officially announced but was reported today by media outlets including Axios and The Washington Post. Biden’s announcement is expected to be made today, the Post wrote.

If confirmed by the Senate, Bedoya would be part of a 3-2 Democratic majority at the FTC. The FTC currently has a full slate of five commissioners, but a spot will open up because Democratic Commissioner Rohit Chopra was nominated to become director of the Consumer Financial Protection Bureau.

Separately, Biden still needs to nominate a Democrat to the Federal Communications Commission, which has been stuck with a 2-2 deadlock since Biden’s inauguration.

Alvaro “blazed a trail in holding Big Tech accountable”

The FTC is led by Chair Lina Khan, whose criticism of Big Tech has spooked Facebook and Amazon, both of which claim she should recuse herself from antitrust investigations into the companies.

Consumer advocacy groups cheered Khan’s nomination to the FTC and are similarly pleased by Biden’s choice of Bedoya. Alvaro “blazed a trail in holding Big Tech accountable and has spent his career fighting on behalf of the powerless, particularly those in immigrant communities. His scholarship and advocacy revealed how Big Data is used to facilitate oppressive surveillance and racial discrimination against the most vulnerable,” Public Knowledge Competition Policy Director Charlotte Slaiman said today.

Free Press President Craig Aaron called Alvaro a “brilliant thinker and accomplished advocate on privacy and technology issues” who will “ensure that the impacts and needs of immigrants and communities of color are a priority… The Senate should move as quickly as possible to confirm him and ensure that the FTC can work at full strength to advance its work, which has never been more important.”

Update at 4:30 pm ET: Biden made the nomination official in an announcement today. Khan issued a statement on the nomination, saying that “Alvaro’s expertise on surveillance and data security and his longstanding commitment to public service would be enormously valuable to the commission as we work to meet this moment of tremendous need and opportunity.”

Privacy as a civil right

In a 2020 New Mexico Law Review paper titled “Privacy as Civil Right,” Bedoya wrote that “across American history, the burdens of government surveillance have fallen overwhelmingly on the shoulders of immigrants, heretics, people of color, the poor, and anyone else considered ‘other.'” Modern examples include “racial bias in face recognition technology” and a scuttled plan by Immigration and Customs Enforcement (ICE) “to automatically and continuously scan immigrants’ social media—their Facebook, Twitter, and Instagram posts—and flag a minimum… of 10,000 of them per year for deportation investigations,” he wrote. (The 2017 plan was dropped after protest by civil rights and privacy organizations, Bedoya’s paper noted.)

Bedoya argued for more transparency into how technology is used for surveillance.

“Right this second, you can go online and find out how many times federal judges here in New Mexico ordered a wiretap, what crimes were involved, how long those wiretaps ran, how many arrests were made, and how many people were convicted. Wiretaps have been around for ages. Why can’t we do this for any surveillance technology invented in the 21st century?” Bedoya wrote.

https://arstechnica.com/?p=1794183

Since early August, Twitch has been wrestling with an epidemic of harassment, known as “hate raids,” against marginalized streamers. These attacks spam streamers’ chats with hateful and bigoted language, amplified dozens of times a minute by bots. On Thursday, after a month trying and failing to combat the tactic, Twitch resorted to the legal system, suing two alleged hate raiders [PDF] for “targeting black and LGBTQIA+ streamers with racist, homophobic, sexist and other harassing content” in violation of its terms of service.

“We hope this Complaint will shed light on the identity of the individuals behind these attacks and the tools that they exploit, dissuade them from taking similar behaviors to other services, and help put an end to these vile attacks against members of our community,” a Twitch spokesperson said in a comment to WIRED.

Harassment based on gender, race, and sexuality is not new to the 10-year-old game-streaming platform; however, over the last month, targeted hate raids have escalated. Marginalized streamers receive derogatory messages—sometimes hundreds at a time—like “This channel now belongs to the KKK.” To raise awareness of the hate raids and pressure Twitch to act, thousands of streamers have banded together under hashtags like #TwitchDoBetter and #ADayOffTwitch, a one-day boycott of the service.

Twitch has instituted several changes aimed at mitigating hate raids. The company says it has banned thousands of accounts over the last month, created new chat filters, and has been building “channel-level ban evasion detection.” But stomping out botters is a bit like playing whack-a-mole; the perpetrators continue to make new accounts while obscuring their online identities to avoid accountability. “The malicious actors involved have been highly motivated in breaking our Terms of Service, creating new waves of fake bot accounts designed to harass Creators even as we continually update our sitewide protections against their rapidly evolving behaviors,” a Twitch spokesperson said in a comment to WIRED.

Thursday’s lawsuit, which was filed in the US District Court for the Northern District of California, targets two users, identified only as “Cruzzcontrol” and “CreatineOverdose,” whom Twitch believes are based, respectively, in the Netherlands and Vienna, Austria. Twitch, in the suit, says it initially took “swift action” by suspending and then permanently banning their accounts. However, it reads, “They evaded Twitch’s bans by creating new, alternate Twitch accounts, and continually altering their self-described ‘hate raid code’ to avoid detection and suspension by Twitch.” The complaint alleges that Cruzzcontrol and CreatineOverdose still operate multiple accounts on Twitch under aliases, as well as thousands of bot accounts, to conduct hate raids, and that both users claim, in the lawsuit’s words, that they can “generate thousands of bots in minutes for this purpose.” Twitch alleges that Cruzzcontrol is responsible for about 3,000 bots associated with these recent hate raids.

On August 15, the suit alleges, CreatineOverdose demonstrated how their bot software “could be used to spam Twitch channels with racial slurs, graphic descriptions of violence against minorities, and claims that the hate raiders are the ‘K K K.’” The suit also alleges that the defendants may be part of a “hate raiding community,” which coordinates attacks over Discord and Steam.

Twitch has gotten into legal fisticuffs with bot-makers in the past. In 2016, the company sued several bot-makers who artificially inflated viewer and follower numbers—what Twitch’s senior vice president for marketing, Matthew DiPietro, at the time called “a persistent frustration.” A California judge ruled in Twitch’s favor, ordering the bot-makers to pay the company $1.3 million for breach of contract, unfair competition, violation of the Anti-Cybersquatting Consumer Protection Act, and trademark infringement. Thursday’s suit can potentially help uncover the identities of the anonymous hate raiders so they can face legal consequences, too.

“I feel hopeful,” says Raven, a streamer who goes by RekItRaven on Twitch. Raven has been outspoken about the hate raids they continue to suffer through and helped coordinate both the #TwitchDoBetter and #ADayOffTwitch movements. “The people who are behind this need to be held accountable for their actions. They’ve terrorized hundreds if not thousands of people. If this were to happen in a physical location we’d expect the same. It shouldn’t be any different online.”

This story originally appeared on wired.com.

https://arstechnica.com/?p=1793678