Location data sharing from wireless carriers has been a major privacy issue in recent years. Marketers, salespeople, and even bounty hunters were able to pay shadowy third-party companies to track where people have been, using information that carriers gathered from interactions between your phone and nearby cell towers. Even after promising to stop selling the data, the major carriers—AT&T, T-Mobile, and Verizon—reportedly continued the practice in the US until the Federal Communications Commission proposed nearly $200 million in combined fines. Carriers remain perennially hungry to know as much about you as they can. Now, researchers are proposing a simple plan to limit how much bulk location data they can get from cell towers.

Much of the third-party location data industry is fueled by apps that gain permission to access your GPS information, but the location data that carriers can collect from cell towers has often provided an alternative pipeline. For years, it’s seemed like little could be done about this leakage because cutting off access to this data would likely require the sort of systemic upgrades that carriers are loath to make.

At the Usenix security conference on Thursday, though, network security researchers Paul Schmitt of Princeton University and Barath Raghavan of the University of Southern California are presenting a scheme called Pretty Good Phone Privacy that can mask wireless users’ locations from carriers with a simple software upgrade that any carrier can adopt—no tectonic infrastructure shifts required.

“The primary problem we’re trying to address is bulk data collection and the sale of it,” Raghavan says. “We see it as a user privacy issue that carriers can amass this location data whether or not they are currently actively selling it. And our goal here was backward compatibility. We didn’t want the telecoms to have to roll out anything because we knew they weren’t going to.”

The opportunity to collect bulk location data from wireless networks arises from the fact that each SIM card has a permanent ID number, known as an “international mobile subscriber identity,” or IMSI number. When your device reboots, has been inactive for a while, or just needs to establish a fresh connection, it reaches out to the nearest cell tower and presents an IMSI number. This allows carriers to check whether you’ve paid your phone bill and should be allowed access to service, and it also tells the network which cell towers you’re close to. Surveillance tools known as “stingrays” or “IMSI catchers” take advantage of this same interaction to grab your physical location and even eavesdrop on your calls and texts.

To make it more difficult to track you all the time, wireless standards already assign each device a random, rotating ID after the initial IMSI exchange. This means that there are already some protections built into the system; making that first IMSI step more private would have far-reaching benefits for users.

Pretty Good Phone Privacy, whose name is a nod to the groundbreaking 1991 communication encryption program Pretty Good Privacy, aims to achieve just that by reimagining the billing check that networks perform. The researchers propose installing portals on every device—using an app or operating system function—that run regular checks with a billing server to confirm that a user is in good standing. The system would hand out digital tokens that don’t identify the specific device but simply indicate whether the attached wireless account is paid up. When the device attempts to connect to a cell tower, the exchange would funnel through this portal for a “yes” or “no” on whether to provide service. The researchers further realized that if the system has an alternate method of confirming billing status, it can accept the same IMSI number or any random ID for each user.

“When you attach to the network, you offer the IMSI number to show the backend database that you are a paying customer, and here are the services that you have subscribed to,” Schmitt says. “The system then informs the rest of the core to allow you onto the network. But what we do with PGPP changes the calculus. The subscriber database can verify that you’re a paying user without knowing who you are. We’ve decoupled and shifted billing and authentication.”

Reworking some billing systems and distributing an app to users would be far more manageable for carriers than deeper network overhauls. Raghavan and Schmitt are in the process of turning their research into a startup to make promoting the project easier among United States telecoms. They acknowledge that even with the ease of adoption, it’s still a long shot that the whole industry would shift to PGPP anytime soon. But getting only a few carriers, they say, could still make a big difference. That’s because bulk location data becomes much less reliable if any significant portion of the total set is tainted. If 9 million Boost Mobile subscribers, for instance, were to broadcast identical or randomized IMSI numbers, that would undermine the accuracy and usefulness of the entire data set.

The fact that small, virtual providers who don’t even operate their own cell towers—known as MVNOs—could implement this scheme independently is significant, says cryptographer Bruce Schneier, who originally learned about PGPP in January and has recently become a project adviser.

“One carrier can do it on their own without anybody’s permission and without anybody else changing anything,” Schneier says. “I can imagine one of these smaller companies saying they’re going to offer this as a value-add because they want to differentiate. This is privacy at very little cost. That’s the neat thing.”

In the competitive, monolithic wireless market, standing apart on privacy could be appealing as a marketing tactic. It’s possible that the big three carriers could attempt to block MVNOs from adopting something like PGPP through contractual moratoria. But the researchers say that some MVNOs have expressed interest in the proposal.

Between potential pressure from law enforcement and loss of data access—plus the need to distribute an app or get mobile operating systems to participate—carriers could have little incentive to adopt PGPP. To the extent that law enforcement might oppose such a scheme, Schmitt notes that it would still be possible for carriers to perform targeted location history lookups for specific phone numbers. And the researchers say they believe the approach would be legal in the US under the Communications Assistance for Law Enforcement Act. This is because one caveat of PGPP is that it only adds privacy protections for cell tower interactions that involve data networks like 4G or 5G. It doesn’t attempt to interoperate with the historic telephony protocols that facilitate traditional phone calls and SMS text messages. Users would need to rely on VoIP calling and data-based messaging for maximum privacy.

The approach also focuses on IMSI numbers, along with their 5G counterparts known as Subscription Permanent Identifiers, or SUPI, and it doesn’t protect or occlude static hardware identifiers like International Mobile Equipment Identity (IMEI) numbers or media access control (MAC) addresses. These aren’t used in the cell tower interactions the researchers are trying to anonymize, but they could provide other avenues for tracking.

Having a simple and straightforward option to address one major location data exposure is still significant, though, after years of data misuse and rising privacy concerns.

“Just to be totally frank, the feeling for me now is, how did we not see this before?” Raghavan says. “It’s not, ‘Wow, this was so difficult to figure out.’ It’s obvious in retrospect.”

“That actually made us feel better as systems researchers,” Schmitt adds. “Ultimately, the simpler the system, the better the system.”

This story originally appeared on wired.com.

https://arstechnica.com/?p=1787083

Supreme Court Justice Amy Coney Barrett yesterday rejected a request to block Indiana University’s requirement that students be vaccinated against COVID-19.

“The case, Klaassen v. Trustees of Indiana University, was the first test of COVID-19 vaccine requirements to arrive at the Supreme Court,” SCOTUSblog wrote. “The rule at the center of the case, announced in May by the university, requires all faculty, students, and staff to be vaccinated unless they qualify for a medical or religious exemption. Eight students went to federal court to challenge the constitutionality of the mandate, but on July 18 a federal district judge in Indiana rejected their request to block the mandate, and the US Court of Appeals for the 7th Circuit declined to put the mandate on hold while the litigation continues.”

Students challenging the mandate asked for an emergency injunction that would block it, but the docket says that the application was “denied by Justice Barrett.” Students claimed they have “a constitutional right to bodily integrity, autonomy, and of medical treatment choice in the context of a vaccination mandate” and that the university “is treating its students as children who cannot be trusted to make mature decisions.” Barrett “rejected the plea without even asking the university for a response or getting her colleagues to weigh in,” the Associated Press wrote.

Fight against mandate has low likelihood of success

The students’ request for an emergency injunction came in the form an application to an individual justice. “Justices often act on their own in such situations when the legal question isn’t particularly close. Barrett handles emergency matters from the US Court of Appeals for the 7th Circuit, which includes Indiana,” the AP noted.

The denial doesn’t necessarily prevent the students from filing a petition for certiorari that asks the full court to take up the case. A request for emergency action to one justice and a petition for certiorari to the entire court can be filed simultaneously.

To win an emergency order from a justice, a petitioner must show “that there is a ‘reasonable probability’ that four justices will grant certiorari, or agree to review the merits of the case; that there is a ‘fair prospect’ that a majority of the court will conclude upon review that the decision [by a lower court] on the merits was erroneous; [and] that irreparable harm will result from the denial of the stay,” the Supreme Court says in a document explaining the procedure. Barrett’s outright dismissal of the Indiana students’ application suggests that they don’t have much of a case.

“If a justice acts alone to deny an application, a petitioner may renew the application to any other justice of his or her choice, and theoretically can continue until a majority of the court has denied the application. In practice, renewed applications usually are referred to the full court to avoid such a prolonged procedure,” the court says. If a justice grants an application, “the other side may file a motion to the full court to vacate that justice’s stay. As a practical matter, these are rarely, if ever, granted.”

No “fundamental right” to avoid vaccines

The appeals court ruling that denied the students’ request on August 2 cited Jacobson v. Massachusetts, a 1905 case in which the Supreme Court backed a state vaccination law.

“Given Jacobson v. Massachusetts, which holds that a state may require all members of the public to be vaccinated against smallpox, there can’t be a constitutional problem with vaccination against SARS-CoV-2,” said the decision by a three-judge panel at the appeals court. The plaintiffs also made a due-process argument, but multiple court decisions show that “such an argument depends on the existence of a fundamental right ingrained in the American legal tradition,” the ruling said. “Yet Jacobson, which sustained a criminal conviction for refusing to be vaccinated, shows that plaintiffs lack such a right. To the contrary, vaccination requirements, like other public-health measures, have been common in this nation.”

Moreover, “this case is easier than Jacobson for [Indiana] University” because the school “has exceptions for persons who declare vaccination incompatible with their religious beliefs and persons for whom vaccination is medically contraindicated… Indeed, six of the eight plaintiffs have claimed the religious exception, and a seventh is eligible for it. These plaintiffs just need to wear masks and be tested, requirements that are not constitutionally problematic.”

Another point in Indiana University’s favor is that it simply made the vaccination a condition of attending the school, judges wrote. The Massachusetts law that was upheld in the century-old case had to meet a higher standard because it required every adult member of the public to be vaccinated. “People who do not want to be vaccinated may go elsewhere,” the appeals court justices noted. “Many universities require vaccination against SARS-CoV-2, but many others do not. Plaintiffs have ample educational opportunities.”

https://arstechnica.com/?p=1787142

Apple’s decision to have iPhones and other Apple devices scan photos for child sexual abuse material (CSAM) has sparked criticism from security experts and privacy advocates—and from some Apple employees. But Apple believes its new system is an advancement in privacy that will “enabl[e] a more private world,” according to Craig Federighi, the company’s senior VP of software engineering.

Federighi defended the new system in an interview with The Wall Street Journal, saying that Apple is aiming to detect child sexual abuse photos in a way that protects user privacy more than other, more invasive scanning systems. The Journal wrote today:

While Apple’s new efforts have drawn praise from some, the company has also received criticism. An executive at Facebook Inc.’s WhatsApp messaging service and others, including Edward Snowden, have called Apple’s approach bad for privacy. The overarching concern is whether Apple can use software that identifies illegal material without the system being taken advantage of by others, such as governments, pushing for more private information—a suggestion Apple strongly denies and Mr. Federighi said will be protected against by “multiple levels of auditability.”

“We, who consider ourselves absolutely leading on privacy, see what we are doing here as an advancement of the state of the art in privacy, as enabling a more private world,” Mr. Federighi said.

In a video of the interview, Federighi said, “[W]hat we’re doing is we’re finding illegal images of child pornography stored in iCloud. If you look at any other cloud service, they currently are scanning photos by looking at every single photo in the cloud and analyzing it. We wanted to be able to spot such photos in the cloud without looking at people’s photos and came up with an architecture to do this.” The Apple system is not a “backdoor” that breaks encryption and is “much more private than anything that’s been done in this area before,” he said. Apple developed the architecture for identifying photos “in the most privacy-protecting way we can imagine and in the most auditable and verifiable way possible,” he said.

The system has divided employees. “Apple employees have flooded an Apple internal Slack channel with more than 800 messages on the plan announced a week ago, workers who asked not to be identified told Reuters,” the Reuters news organization wrote yesterday. “Many expressed worries that the feature could be exploited by repressive governments looking to find other material for censorship or arrests, according to workers who saw the days-long thread.”

While some employees “worried that Apple is damaging its leading reputation for protecting privacy,” Apple’s “[c]ore security employees did not appear to be major complainants in the posts, and some of them said that they thought Apple’s solution was a reasonable response to pressure to crack down on illegal material,” Reuters wrote.

Phones to scan photos before uploading to iCloud

Apple announced last week that devices with iCloud Photos enabled will scan images before they are uploaded to iCloud. An iPhone uploads every photo to iCloud almost immediately after it is taken, so the scanning would also happen almost immediately if a user has previously turned iCloud Photos on.

As we reported, Apple said its technology “analyzes an image and converts it to a unique number specific to that image.” The system flags a photo when its hash is identical or nearly identical to the hash of any that appear in a database of known CSAM. Apple said its server “learns nothing about non-matching images,” and even the user devices “learn [nothing] about the result of the match because that requires knowledge of the server-side blinding secret.”

Apple also said its system’s design “ensures less than a one in one trillion chance per year of incorrectly flagging a given account” and that the system prevents Apple from learning the result “unless the iCloud Photos account crosses a threshold of known CSAM content.” That threshold is approximately 30 known CSAM photos, Federighi told the Journal.

While Apple could alter the system to scan for other types of content, the company on Monday said it will refuse any government demands to expand beyond the current plan of using the technology only to detect CSAM.

Apple is separately adding on-device machine learning to the Messages application for a tool that parents will have the option of using for their children. Apple says the Messages technology will “analyze image attachments and determine if a photo is sexually explicit” without giving Apple access to the messages. The system will “warn children and their parents when receiving or sending sexually explicit photos.”

Apple said the changes will roll out later this year in updates to iOS 15, iPadOS 15, watchOS 8, and macOS Monterey and that the new system will be implemented in the US only at first and come to other countries later.

Federighi: “Messages got jumbled pretty badly”

Federighi said that critics have misunderstood what Apple is doing. “It’s really clear a lot of messages got jumbled pretty badly in terms of how things were understood,” Federighi told The Wall Street Journal. “We wish that this would’ve come out a little more clearly for everyone because we feel very positive and strongly about what we’re doing.”

The simultaneous announcement of two systems—one that scans photos for CSAM and another that scans Messages attachments for sexually explicit material—led some people on social media to say they are “worried… about having family photos of their babies in the bath being flagged by Apple as pornography,” the Journal noted.

“In hindsight, introducing these two features at the same time was a recipe for this kind of confusion,” Federighi said. “By releasing them at the same time, people technically connected them and got very scared: What’s happening with my messages? The answer is… nothing is happening with your messages.”

https://arstechnica.com/?p=1787043

The hacker who breached the Poly Network crypto platform says the theft was just “for fun :)” and that the hacker is now returning the stolen coins. The hacker also claimed that the tokens had been transferred to the hacker’s own wallets to “keep it safe.”

Poly Network first disclosed the hack on Tuesday, saying that the hacker, or hackers, had stolen crypto coins worth about $600 million at the time of the heist. The thousands of tokens included $270 million on the Ethereum blockchain, $250 million on the Binance Smart Chain, $84 million on the Polygon network, and a smattering of other smaller coins, like Tether, Shiba Inu, and Matic.

As of 4 am this morning, Poly Network says $342 million has been returned. The remainder, which is apparently all in Ethereum, is being “gradually transferred,” the company said.

Poly Network operates a platform that allows people to move tokens between different blockchains, using smart contracts that help to automate the process. The hacker exploited a vulnerability in one of Poly Network’s smart contracts, the company said in a tweet. That smart contract required a large amount of liquidity so that transactions between different blockchains could be completed quickly and efficiently.

How and why

The hacker apparently exploited a vulnerability in the way Poly Network verified smart contracts to change a list of public keys to match the hacker’s private keys, according to an analysis of the hack tweeted by Kelvin Fichter. Once those keys were changed, the hacker was able to reroute funds to personal wallets.

In an exclamation point-laden, all-caps Q&A found within one of the transactions, the hacker gave some insight into the motivation behind the hack. (We cannot verify the authenticity of the statements, though one expert said they were linked to the hacker’s account. Also, we’ve changed the passages to sentence case to make them more readable.) “When spotting the bug, I had a mixed feeling,” the hacker wrote. “Ask yourself what [would you] do had you fac[ed] so much fortune. Ask the project team politely so that they can fix it? Anyone could be the traitor given one billion!”

The hacker also gave a reason for returning the funds, claiming, “That’s always the plan! I am not very interested in money! I know it hurts when people are attacked, but shouldn’t they learn something from those hacks?”

Though the hacker wasn’t going to pass up on some extra cash, of course. “In the meanwhile, depositing the [stable coins, like Tether,] could earn some interest to cover potential cost so that I have more time to negotiate with the Poly team,” the hacker said.

Negotiating tactics

Shortly after Poly Network revealed the breach, it posted a note to the hacker on Twitter. “The amount of money you hacked is the biggest one in defi history. Law enforcement in any country will regard this as a major economic crime and you will be pursued. It is very unwise for you do to any further transactions.”

This negotiating tactic—along with Tether freezing $33 million of its coins on Poly Network—seems to have worked. The difficulty in moving that amount of cryptocurrency anonymously likely also posed a challenge for the hacker, said Joel Kruger, a currency strategist at LMAX Group, to The Wall Street Journal. “You’re going to have to find a way to get it out to cash in—it becomes a greater impossibility given how things are tracked from wallet to wallet and exchange to exchange,” he said.

Less than a day after the note was posted, the hacker began sending the stolen cryptocurrency back to the company.

In the Q&A, the hacker attempt to pose as a white hat, writing, “I understood the risk of exposing myself even if I don’t do evil. So I used temporary email, IP, or so called fingerprint, which were untracable [sic].”

The hacker capped off the answer with what may be a sarcastic wink at the crypto community: “I prefer to stay in the dark and save the world.”

https://arstechnica.com/?p=1786849

Apple and Google seem to be worried about legislation that would force iOS and Android to be more open to third-party app stores and sideloaded apps.

US Senators Richard Blumenthal (D-Conn.), Marsha Blackburn (R-Tenn.), and Amy Klobuchar (D-Minn.) introduced their Open App Markets Act yesterday. Shortly after the senators announced the bill, a group funded by Apple and Google sent a statement to media claiming that the proposed law “is a finger in the eye of anyone who bought an iPhone or Android because the phones and their app stores are safe, reliable, and easy to use.”

The statement came from the “Chamber of Progress,” which calls itself “a new center-left tech industry policy coalition promoting technology’s progressive future.”

“I don’t see any consumers marching in Washington demanding that Congress make their smartphones dumber. And Congress has better things to do than intervene in a multi-million dollar dispute between businesses,” said Chamber of Progress CEO Adam Kovacevich, who was formerly a longtime Google lobbyist.

Kovacevich played key role at Google

The Chamber of Progress’ website lists 20 “corporate partners,” with Apple and Google being the most relevant ones in this case. Amazon, Facebook, and Twitter are also funders. The group says its “partners do not sit on our board of directors and do not have a vote on or veto over our positions” and that “we do not speak for individual partner companies and remain true to our stated principles even when our partners disagree.”

But the group’s lobbying against the new app-store legislation neatly matches the positions of Apple and Google, which have been fighting attempts to make their mobile operating systems more open. Apple issued a statement yesterday that conveyed the same basic message in a less combative way. “At Apple, our focus is on maintaining an App Store where people can have confidence that every app must meet our rigorous guidelines and their privacy and security is protected,” the company said, according to CNBC. Google declined to comment when contacted by Ars today but has pointed out that Android is more open to app stores and sideloaded apps than iOS.

The Chamber of Progress became active a few months ago and also lobbied against antitrust legislation that could prohibit platform operators like Amazon, Apple, Google, and Facebook from favoring their own products and services and even break up Big Tech companies.

Kovacevich’s bio on the Chamber of Progress website says he “previously led Google’s 15-person US policy strategy and external affairs team” and approvingly quotes a June 2019 Wall Street Journal article that said Kovacevich “helped build [Google’s] influence operation into one of the largest in the nation’s capital” and was “a central player in Google’s efforts to shape perceptions and rules in ways that have been favorable to the business of the search and advertising giant.” The bio also says Kovacevich “ran Google’s work to close its 2011–2013 FTC antitrust investigation.”

“Tear down coercive anticompetitive walls”

The lawmakers’ announcement of their bill said that “Google and Apple have gatekeeper control of the two dominant mobile operating systems and their app stores that allow them to exclusively dictate the terms of the app market, inhibiting competition and restricting consumer choice.” The lawmakers summarize the legislation as follows:

The Open App Markets Act would protect developers’ rights to tell consumers about lower prices and offer competitive pricing; protect sideloading of apps; open up competitive avenues for startup apps, third party app stores, and payment services; make it possible for developers to offer new experiences that take advantage of consumer device features; give consumers more control over their devices; prevent app stores from disadvantaging developers; and set safeguards to continue to protect privacy, security, and safety of consumers.

Blackburn said that “Apple and Google want to prevent developers and consumers from using third-party app stores that would threaten their bottom line,” while Blumenthal said the two companies “have squashed competitors and kept consumers in the dark—pocketing hefty windfalls while acting as supposedly benevolent gatekeepers of this multi-billion dollar market.”

“This legislation will tear down coercive anticompetitive walls in the app economy, giving consumers more choices and smaller startup tech companies a fighting chance,” Blumenthal said.

What the bill does

The bill covers companies that own or control an app store with at least 50 million US users, obviously targeting Apple and Google. The companies would have to “allow and provide the readily accessible means for users” to “choose third-party Apps or App Stores as defaults for categories appropriate to the App or App Store” and “install third-party Apps or App Stores through means other than its App Store.” Apple and Google would also have to let users “hide or delete Apps or App Stores provided or preinstalled by the App Store owner or any of its business partners.”

Android does allow sideloading and third-party app stores, while Apple locks iOS down more strictly, but both companies could have to change business practices to different degrees if the legislation becomes law. Despite Android’s openness relative to iOS, 36 states sued Google last month, claiming it worked to “preemptively quash” competing app stores.

The Open App Markets Act would prohibit the app-store operators from requiring developers to use the Apple and Google in-app payment systems and from imposing terms that block or penalize developers who offer the same app at a different price elsewhere. Apple and Google also would not be allowed to preference their own apps in search “unreasonably,” which is defined as “applying ranking schemes or algorithms that prioritize apps” simply because they are owned by Apple and Google or their business partners. Clearly disclosed advertising is exempt from that provision.

To help third-party software developers, the bill says Apple and Google must provide “access to operating system interfaces, development information, and hardware and software features” to developers “on a timely basis and on terms that are equivalent or functionally equivalent” to the terms that apply to Apple and Google or their business partners.

Violations of the bill would be considered unfair methods of competition under US law. The Federal Trade Commission, US attorney general, and state attorneys general would be able to sue companies over violations. Developers who are “injured by reason of anything forbidden in this act” would be able to sue the companies for damages and injunctive relief.

Addressing security

Apple and Google would likely object to the bill on security grounds. Apple in particular has touted the security benefits of the iOS app model that generally prevents the installation of software from outside the App Store. To address this issue, the Open App Markets Act allows the companies to impose restrictions designed solely for security purposes, although this is nebulously defined.

The bill says that actions by app-store operators would not violate the proposed law if they are “necessary to achieve user privacy, security, or digital safety; taken to prevent spam or fraud; or taken to prevent a violation of, or comply with, federal or state law.” To obtain this exemption, Apple and Google would have to establish “by clear and convincing evidence that the action described is applied on a demonstrably consistent basis to apps of the covered company or its business partners and to other apps; not used as a pretext to exclude, or impose unnecessary or discriminatory terms on, third-party apps, in-app payment systems, or app stores; and narrowly tailored and could not be achieved through a less discriminatory and technically possible means.”

App battle on the way

The quick response from the Apple- and Google-funded group to yesterday’s announcement foreshadows another battle on Capitol Hill if the bill moves forward. Apple in June “launched a substantial public-relations push” against “calls from regulators to open the gates to alternative app stores and sideloaded apps on the iPhone,” as we wrote at the time. CEO Tim Cook said that sideloading is “not in the best interests of the user,” while another Apple executive claimed that “sideloading in this case is actually eliminating choice” and described sideloading as the app-installation equivalent of “some dark alley or side road.”

When the 36 states filed their antitrust lawsuit against Google last month, Google called the complaint meritless and said it is “strange that a group of state attorneys general chose to file a lawsuit attacking a system that provides more openness and choice than others.” Meanwhile, a “Coalition for App Fairness,” with members such as Spotify, Epic Games, Match Group, Basecamp, ProtonMail, and Deezer, is on board with the Open App Markets Act.

“The Open App Markets Act would fix a broken app marketplace by barring app stores from requiring apps to use their in-app payment systems, through which they charge exorbitant fees and block communications between developers and their own customers,” the group said. “It would also strengthen consumer freedom by allowing people to choose and install the app store and default apps that make the most sense for them and easily delete preinstalled apps they don’t want to use.”

https://arstechnica.com/?p=1786775

Amazon Web Services (AWS) has been named the winner of a $10 billion cloud computing contract, called “WildandStormy,” for the National Security Agency. But Microsoft, no doubt still salty about Amazon’s successful challenge of Redmond’s $10 billion JEDI contract with the Pentagon, filed a formal bid protest with the Government Accounting Office last month. 

Microsoft says that if the NSA had properly evaluated the bids, Microsoft would have won. The GAO will decide the outcome of the protest by the end of October. The news was first reported by the trade publication Washington Technology.

The award and protest come as US intelligence agencies have been looking at overhauling their computing and storage resources over the last several years. Currently, many of the agencies’ cloud operations use so-called GovCloud products from various vendors, including Amazon’s AWS and Microsoft’s Azure. The initial move to the cloud was spurred years ago by the exponential increase in data that intelligence agencies were gathering and analyzing. That increase was outpacing the agencies’ ability to store it all in-house. AWS was an early winner and secured a $600 million contract with the CIA in 2013.

After years of using GovCloud services tailored for the intelligence community, the NSA, CIA, and Pentagon have been soliciting bids for new cloud computing contracts. In November, the CIA announced an award for its Commercial Cloud Enterprise program with a 15-year contract worth tens of billions of dollars. It was granted to AWS, Microsoft, Google, Oracle, and IBM. As different needs arise at the agency, the five companies will compete for subcontracts.

Less is known about the NSA’s WildandStormy program, though it appears to be a part of the agency’s Hybrid Compute Initiative, which blends more traditional cloud services with hardware-as-a-service (HaaS) products from “one of the bigger players,” NSA Chief Information Officer Greg Smithberger told Janes last year. It’s unclear if he was referring to AWS at the time.

The HaaS requirement stems from the fact that the NSA says some of its applications require more specialized computing. “There are some of the [network] pieces that are a little more exotic… there are pieces of this that are a little too hard to re-factor and move into a [commercial] cloud service,” Smithberger said. 

The hybrid approach would allow the NSA to offload the management of more of its operations, allowing the agency to divvy up its more traditional and more specialized storage and computing needs while still working with the same providers.

“NSA is always on all the time and running a very high capacity—it’s like a jet engine that’s wide open all the time, given the NSA requirements,” acting Department of Defense CIO John Sherman said to FedScoop. “There is nothing elastic about what goes on with the mission at Fort Meade,” he added. “The software they have in GovCloud now needs to run, in some instances, on bare metal to be able to get that extra oomph of performance off of that.”

AWS has provided cloud computing to the intelligence community for nearly a decade, giving the service a formidable advantage over its competitors. In recent years, Microsoft has made a play for those contracts by building facilities that can be accredited to handle secret and top-secret data.

But despite Microsoft’s presence in the field, AWS continues to have the upper hand. “[The NSA’s award] just reiterates that Amazon is still the cloud provider to beat across the federal government,” Chris Cornillie, an analyst at Bloomberg Government, told Nextgov. “Microsoft has come a long way and made it a two-way horse race in government, but Amazon was forming relationships and gathering security certifications a decade ago, and Microsoft is still playing catch-up.”

https://arstechnica.com/?p=1786735

Last week, Ron Watkins—conspiracy theorist, QAnon enthusiast, and former 8chan site admin—released photocopies of an installation manual for Dominion voting machines. The copied pages gave basic instructions for configuring BIOS passwords (necessary to change some system settings) and iDRAC, a standard network remote control tool (which the manual explicitly requires the administrator to disable).

The next day, Watkins released a video purporting to be from a “whistleblower” exposing Dominion’s “most egregious lie”—that Dominion can remotely administer the machines, he said. He also released several screenshots of Election Management Systems hardware his “whistleblower” had access to.

Although none of Watkins’ screenshots—which will be immediately familiar to anyone who’s ever administered enterprise-grade hardware—are as damning to the voting machines as Watkins would clearly like, they did end up causing problems for one of Watkins’ fellow travelers: county clerk Tina Peters of Mesa County, Colorado, whose office manages the machines in question.

BIOS and iDRAC and NICs, oh my!

The thrust of Watkins’ accusations is that Dominion’s Election Management Systems (EMS) voting machines are connected to the Internet and remotely controllable by Dominion itself. His grainy video, blurry screenshots, and hastily photocopied manual pages attempt to paint a picture of voting machines that are always connected to the Internet and remotely managed by Dominion.

Unfortunately for this narrative, all this leaked media really exposes is a generic set of server hardware, with explicit instructions to keep it off the Internet and lock down its remote management functions. Watkins’ video cuts together footage of Dominion CEO John Poulos telling US senators that the machines aren’t designed for Internet connectivity with footage of the EMS servers’ BIOS setup interface. The BIOS shots include configuration options for iDRAC, a Dell-specific technology for remote control of server hardware.

Curiously, Watkins also includes—although he does not address—Poulos’ statement that Dominion does not have access to the passwords necessary to access these technologies. He also leaves in the part of his “whistleblower” video in which the Dominion employee states, “[We don’t have access to] the BIOS passwords… the state is keeping them.” And he ignores the installation manual’s explicit instructions to disable iDRAC entirely.

Watkins appears intent to convince less technically savvy viewers that Dominion specifically designed these machines to be remotely managed at all times—a narrative contradicted by Dominion’s own installation procedures and the fact that the state manages BIOS passwords (which someone with physical access to the machine could use to enable iDRAC) as its own secure assets.

There’s a case to be made that voting machines shouldn’t be built from generic server hardware that includes functionality like iDRAC in the first place—but that more-reasonable case does not appear to be the one that Watkins wants to promote.

“A minor slip-up could potentially dox the whistleblower”

Watkins littered his Telegram with surreptitiously taken photos of EMS server screens—including one of a bootable Acronis partition manager showing the device’s drive layout. He captioned the image: “Individual frames need to be redacted very carefully. A minor slip-up could potentially dox the whistleblower.” (That screenshot redacts the volume name of a portable SSD connected to the EMS machine.)

Unfortunately, Watkins seems longer on advice than practice—another photo, which came with the caption “our whistleblower risked his life / his livelihood / his everything,” shows a spreadsheet of BIOS passwords for a small collection of computers, including EMS server and client systems.

It seems likely that Watkins intended the spreadsheet photo to scare his audience into either believing that anyone at all could access the EMS systems or that Dominion itself could. Instead, the photo constituted Watkins’ most serious own goal. The passwords he exposed are managed at the state level, and when the state of Colorado got wind of the leaked photo, it identified the passwords as belonging to systems managed by its own Mesa County.

Colorado secretary of state has joined the chat

In response to the leaked BIOS passwords, Colorado Secretary of State Jena Griswold issued an executive order—as reported by the Grand Junction Daily Sentinel—requiring the Mesa County Clerk and Recorder’s office to supply surveillance videos and documents showing how and to whom the BIOS passwords were leaked.

This is an order with real teeth—the BIOS passwords are protected by policy and should only be available to a few state and county election workers who have passed background checks. If Mesa County Clerk Tina Peters can’t demonstrate a proper chain of custody for how the leaked information was maintained, the county’s election systems could be decertified, resulting in an expensive, mandatory refit of the machines involved—all on the county’s dime.

Pro-Trump, anti-Biden, anti-vax

Although there’s no evidence directly implicating Peters with the leak, she makes a tempting suspect—during the 2021 Capitol insurrection, Peters blasted Twitter with a series of now-deleted tweets claiming that the 2020 presidential election was fraudulent and that she herself, as a county election administrator, had special inside knowledge about how to falsify an election.

In another since-deleted tweet, Peters makes a baseless statement that “the vaccines are troubling in the mechanics in the RNA.” In a better world, COVID vaccine fearmongering wouldn’t be related to election-machine security—but in this world, it places Peters further in Watkins’ sphere of intertwined conspiracy theories.

Pat Poblete of the Colorado Springs Gazette reports that Peters isn’t responding to Secretary of State Griswold’s order to turn over equipment, surveillance footage, and documents. Instead, Peters flew to South Dakota, where she addressed a so-called “Cyber Symposium” hosted by election conspiracy theory enthusiast and MyPillow CEO Mike Lindell.

In Peters’ absence, Griswold obtained a search warrant and sent a team to the Mesa County Clerk’s Office. On stage at Lindell’s symposium, Peters said Griswold “invade[d] my elections department today,” complaining that “we don’t know what they were doing in there” because her chief deputy clerk was not allowed to observe the search. Griswold’s own press release states that her office’s inspection team was “accompanied at all times by officials from Mesa County.”

Peters denied any personal involvement in the security breach during her remarks Tuesday night, and she hinted that she plans to release more information on Mesa County voting systems at Lindell’s symposium on Thursday.

https://arstechnica.com/?p=1786499

A decentralized financial network has claimed hackers absconded with about $600 million worth of cryptocurrencies in one of the largest heists to target the growing digital asset industry.

Poly Network, which links some of the world’s most widely used digital ledgers, said on Tuesday that attackers had exploited a vulnerability in its system and taken thousands of crypto tokens. The attack would be one of the largest to date on a crypto venture, on a par with breaches of exchanges Coincheck and Mt. Gox.

The alleged hack was a blow to supporters of decentralized finance, or DeFi, which has been one of the fastest-expanding areas of the booming cryptocurrency market. It also highlighted the lack of consumer and investor protections in a market with only light oversight from financial regulators.

Poly Network has developed a computer protocol, or set of rules, that allows users to transfer tokens tied to one blockchain to a different network. Many of the world’s most widely used blockchains, such as Binance Chain and Ethereum, have developed independently, and their coins, offered as an incentive to users, run on separate technologies.

That means investors cannot easily move their tokens to a different blockchain to trade them or use them as collateral for another investment.

Proponents are trying to build networks that allow users to buy and sell digital assets directly with each other, bypassing intermediaries that impose fees such as exchanges or clearinghouses. Many projects aim to be fully decentralized.

The alleged hacker exploited a vulnerability in Poly Network’s “contract calls,” a type of test that is not intended to be published on the blockchain, to access the ledgers and transfer money, the network said.

The tokens were valued at about $600 million prior to the news of the alleged hack, consisting of more than $270 million on the Ethereum blockchain, $250 million on the Binance Smart Chain, and $84 million on the Polygon network, according to wallet addresses published by Poly Network on Twitter.

Etherscan indicated that the hacker had taken alt-coins such as Binance Coin and ether as well as dozens of smaller tokens, including Shiba Inu, Matic, and Uniswap. The dollar value of the stolen coins dropped to $394 million as news of the theft spread and investors sold cryptocurrencies, knocking the tokens’ prices.

Poly Network called on groups known as “miners,” which process transactions, and centralized crypto exchanges to block transfers. “We will take legal actions and we urge the hackers to return the assets,” it said.

Changpeng Zhao, chief executive of Binance, said his company was aware of the incident. He said while “no one controls” Binance’s blockchain, the group was “coordinating with all our security partners to proactively help.”

“There are no guarantees. We will do as much as we can,” he added.

Paolo Ardoino, chief technical officer at stablecoin company Tether, said the group had frozen about $33 million worth of its tokens, which were on the Poly Network. A substantial proportion was also in USD Coin, operated by payments service company Circle, according to Etherscan. Circle did not immediately respond to a request for comment.

Gary Gensler, chair of the Securities and Exchange Commission, the US markets regulator, had called on lawmakers this month to give watchdogs more power to protect investors from illicit activity on DeFi platforms.

© 2021 The Financial Times Ltd. All rights reserved Not to be redistributed, copied, or modified in any way.

https://arstechnica.com/?p=1786591

Two lawmakers have received temporary account suspensions from YouTube and Twitter over their repeated posting of COVID-19 disinformation, yet videos from both espousing similar disinformation remain on Facebook.

On Tuesday, YouTube removed a video posted by Sen. Rand Paul (R-Ky.) in which he falsely claimed that masks were not effective in preventing the spread of COVID-19. Also yesterday, Twitter suspended Rep. Marjorie Taylor Greene (R-Ga.) for one week after she falsely claimed that neither vaccines nor masks reduce the transmission of COVID. Both masks and vaccines do work, in fact, and there’s ample evidence that wearing masks slows the spread of the disease.

Paul and Greene are suspended from YouTube and Twitter, respectively, for one week. Paul’s suspension was handed down because YouTube had to remove another one of his videos last week. As this is his second offense, his account will be unable to publish for seven days. Greene is now on her fourth strike on Twitter, meaning that another violation could result in her being banned from the platform permanently.

Vaccines for COVID-19 have been very effective in reducing infections, even in the face of the delta variant. In a new preprint study, both Pfizer and Moderna vaccines helped prevent hospitalizations in people exposed to delta. And while they weren’t quite as effective at preventing infections by the new variant, they are still a good tool in reducing the spread of the disease. 

Furthermore, masks, even cloth ones, have been shown to be effective at slowing the transmission of COVID-19. With delta on the rise, masks remain an option for people—vaccinated or not—to reduce exposure and halt the spread of the virus. The CDC is recommending that everyone in areas of substantial or high transmission wear one indoors.

One down…

While YouTube took down one of Paul’s videos, it has yet to remove another in which the senator questions the efficacy of masks despite the evidence that they work. That video, from August 5, is a reposted segment from Fox News in which he said, “The more [mask] mandates we got, the more of the disease we got. Now, I don’t think the mask caused the disease, but I don’t think the mask helped any.” We’ve asked YouTube for comment on why that video remains up while the other was taken down, and we’ll update this story if we receive a response.

Both Paul’s and Greene’s Facebook accounts remain active, though both include videos that rehash similar disinformation about masks. On his Facebook page, Paul reposted the same Fox News segment that remains on his YouTube page. Greene recorded a live video on August 2, which is archived on her Facebook page, in which she said, “You’re going to be arrested if you don’t wear a mask that, guess what, doesn’t work. It’s likely a little piece of cloth covering your face, or a napkin, like a paper mask—those don’t stop COVID from spreading, either.” Both videos remain on Facebook despite ample scientific evidence that masks prevent the spread of COVID-19.

We asked Facebook whether the two videos violate the company’s COVID-related misinformation policies, and we’ll update this story if we hear back.

Other bans

Yesterday, Twitter also permanently banned former San Francisco Giant’s player Aubrey Huff, also for repeated violations of the company’s COVID policy. Huff has become a minor player in far-right circles, frequently posting inflammatory content, downplaying the severity of COVID, and posting outright falsehoods about COVID vaccines. 

Earlier this month, SkyNews Australia, the country’s Fox News equivalent that is also owned by News Corp, was given a “strike” by YouTube, which meant the channel couldn’t post videos for a week. YouTube wouldn’t say which videos violated the platform’s policies, but a spokesperson told CNN that “we don’t allow content that denies the existence of COVID-19 or that encourages people to use hydroxychloroquine or ivermectin to treat or prevent the virus.” 

There’s no evidence to suggest that either drug does anything to help COVID-19 patients. Ivermectin is most commonly used to treat parasitic worm infections—not viral infections—and certain doses can be dangerous. The WHO halted its trials of hydroxychloroquine last year after results showed that COVID-19 patients received no benefit from the drug.

https://arstechnica.com/?p=1786420

Amazon today announced a new policy in which it will pay customers up to nearly $1,000 when a third-party product causes property damage or personal injury. Payments of any amount less than $1,000 will be made at no cost to sellers who hold valid insurance, but Amazon said it will also pay customers more than that when a seller refuses a valid claim.

When “a defective product sold through Amazon.com causes property damage or personal injury, Amazon will directly pay customers for claims under $1,000—which account for more than 80 percent of cases—at no cost to sellers, and may step in to pay claims for higher amounts if the seller is unresponsive or rejects a claim we believe to be valid,” Amazon’s announcement said.

Today’s announcement came less than a month after the US Consumer Product Safety Commission (CPSC) filed a complaint against Amazon over the sale of hundreds of thousands of hazardous products, including carbon monoxide detectors that fail to detect carbon monoxide, hair dryers without required protection from shock and electrocution, and flammable sleepwear meant for children. The CPSC wants Amazon to take more responsibility for dangerous products offered by third parties under the Fulfilled by Amazon (FBA) program, in which Amazon stores products in its warehouses and ships them to customers while taking a cut of the proceeds. As the CPSC noted, people “who purchase FBA consumer products on amazon.com may reasonably believe they are purchasing the products from Amazon.”

The updated claims process seems to apply both to FBA products and those shipped by third-party sellers. Amazon said the guarantee holds “regardless of who sells” the product causing damage or injury.

Technically, payments can go up to $1 million

The change to Amazon’s “A-to-z Guarantee” will take effect on September 1. The claims process terms and conditions, which were updated today, don’t currently mention the $1,000 amount but say that compensation for property damage or personal injury “will be limited to (a) the purchase price of the product; and (b) compensation of up to $1 million for medical expenses, lost wages, and property damage proximately caused by a defective product.”

Obviously, Amazon doesn’t expect to pay $1 million for claims over third-party products very often. The promise to pay small claims at no cost to sellers could minimize objections from third-party merchants while giving customers a reason to avoid litigation. But Amazon customers should remember that they can still sue Amazon for bodily injuries or property damage, especially if the amount offered doesn’t cover their expenses.

“If you do make a claim through the A-to-z Claims Process, you agree you will not file a claim in an alternative forum (like a court or arbitration) until we have a chance to notify you of a decision on your claim,” Amazon’s terms say. Amazon says it “usually” resolves claims within 90 days and that customers can “withdraw a claim made under this process at any time.”

Amazon will investigate each claim

Amazon urges sellers to buy insurance and said it has “worked with an insurance broker to create Amazon Insurance Accelerator,” which will let “sellers buy insurance at competitive rates from trusted providers.” Sellers who buy insurance, whether through Amazon or elsewhere, won’t have to reimburse the company for small claims paid to consumers. For claims under $1,000, “Amazon will bear these costs and not seek reimbursement from sellers who abide by our policies and hold valid insurance,” the company said.

Here’s how Amazon describes the new claims process:

Beginning September 1, for products sold through Amazon.com, Amazon will facilitate resolution of property damage and personal injury claims between the customer, the seller, and their insurance provider. Customers can contact Amazon Customer Service, and we will notify the seller and help them address the claim. If a seller does not respond to a claim, Amazon will step in to directly address the immediate customer concern, bear the cost ourselves, and separately pursue the seller. If a seller rejects a claim we believe is valid, Amazon may also step in to address the customer concern; in these cases, sellers will continue to have the opportunity to defend their product against the claim.

For each case, Amazon said it “will combine our advanced fraud and abuse detection systems with external, independent insurance fraud experts to analyze the claim. We will present valid claims to sellers and deny unsubstantiated, frivolous, or abusive claims. By doing this work on behalf of sellers, we save them from having to investigate these claims on their own.”

Suing Amazon hard but not impossible

Customers who file claims can still sue Amazon if the company rejects the claim. “If we reject a claim for any reason, neither you nor Amazon waives any rights or defenses relating to any claims you might have,” Amazon says in the terms and conditions updated today.

But if Amazon makes an offer and you accept, you have to agree not to sue the company. “You are under no obligation to accept our offer to resolve your claim, but if you do accept it you agree that the claim is settled and finally resolved as to Amazon and the seller who sold you the product,” Amazon says. “To the extent allowable by law, you will also assign your claim to us so that we can pursue recovery from other sources in our discretion.”

When the CPSC took action last month, it said that its evidence includes “lawsuits concerning incidents or injuries involving various consumer products.”

Customers may find it hard to sue Amazon over injuries resulting from third-party products, the McNicholas & McNicholas law firm says. For third-party items that are stored, packed, and shipped by Amazon, there is “a more direct link in the stream of commerce placing items into the hands of customers.” But beating Amazon in court is still difficult.

“Because Amazon doesn’t purchase products from third-party sellers to resell under the Amazon label, third-party transactions tend to muddle the definition of ‘seller’ for product liability purposes,” the law firm says. “In extremely simplified terms, Amazon is almost reduced to nothing more than a delivery service in those cases, so complaints filed against them would likely only relate to delivery issues. That is a far cry from taking blame for an exploding vape pen causing burn injuries or a faulty ladder leading to a wrongful death.”

“Until this area of law changes to hold Amazon accountable for placing defective products into the stream of commerce, winning product liability lawsuits in their true status as the retailer will be more difficult, but not impossible,” McNicholas & McNicholas wrote, pointing to an August 2020 order by a California state appellate court. The ruling said that Amazon can be held liable for an exploding laptop battery that was offered by a third-party seller called Lenoge but stored and shipped by Amazon.

Third-party sellers may simply disappear

In that California case and others involving third-party sellers, Amazon was the only entity that customers could sue with any expectation of success.

“The Amazon website, and especially the FBA program, enables manufacturers and sellers who have little presence in the United States to sell products to customers here… The dilemma for an injured plaintiff is illustrated by this litigation, where two defendants have been served and failed to appear, and a third defendant can only be served in China. Other plaintiffs have encountered similar obstacles,” the court order said.

The exploding-battery case led Amazon to permanently block Lenoge’s account, block sales of the product, and warn customers to stop using the battery because of the fire hazard. Amazon’s extensive control over sales means the company doesn’t automatically escape liability for third-party products, the court ruling said:

Amazon is a direct link in the chain of distribution, acting as a powerful intermediary between the third-party seller and the consumer. Amazon is the only member of the enterprise reasonably available to an injured consumer in some cases, it plays a substantial part in ensuring the products listed on its website are safe, it can and does exert pressure on upstream distributors (like Lenoge) to enhance safety, and it has the ability to adjust the cost of liability between itself and its third-party sellers. Under established principles of strict liability, Amazon should be held liable if a product sold through its website turns out to be defective.

Liability can vary by state. In a Texas case decided in June 2021, which involved a third-party product sold through the Fulfilled by Amazon program, the state Supreme Court found that Amazon was not liable because it did not qualify as a “seller” under Texas law. The harmed consumer sued both Amazon and the seller, who was from China, but the seller “did not answer or make an appearance.” Despite that, “[b]ecause the product in this case was sold on Amazon’s website by a third party and Amazon did not hold or relinquish title, Amazon is not a seller even though it controlled the process of the transaction and the delivery of the product,” the ruling said.

https://arstechnica.com/?p=1786130