Apple employees want to know if they’re being paid equitably, so some of them have been sending surveys to their colleagues to collect compensation information. The surveys are all opt-in, and several hundred people have participated so far.

The surveys stem in part from the fact that, in 2016, Tim Cook told investors that Apple had largely tackled pay inequality at the company. Women at Apple made 99.6 cents for every dollar men made, and underrepresented minorities made 99.7 cents for every dollar white workers made, Apple said. Those numbers probably sounded too good to be true to some people, and questionnaires started popping up in recent months.

At least two surveys were pulled by their authors, The Verge reported, after Apple’s “people team”—what some companies call human resources—claimed various infractions. Apple HR said the first survey’s questions about race, gender, ethnicity, and disability constituted personally identifying information. They nixed the second because it was hosted on the corporate Box account. When reached for comment, an Apple spokesperson would not confirm why the first two surveys were halted.

Now, employees are hosting a new survey using their own TypeForm account, and this one appears to have gained Apple’s tacit blessing. At the very least, it doesn’t seem to have run afoul of any personnel regulations.

The latest version was started by Apple engineer Cher Scarlett. “I was looking at levels.fyi (a website that lets people compare salary data across companies) and noticed a few very low salaries in a certain geographic area that were 10 to 15 percent lower compared to other people on the team,” Scarlett told The Verge. “Every time I looked at gender, they were women. I’m not going to say that’s a definitive issue, but it’s a prompt for anyone to ask if this is a widespread problem. We should be able to easily find out whether or not that’s the case so we can know whether people are truly being paid fairly.”

Voluntary surveys like the kind Apple employees have posted may be protected as a form of union organizing precisely because they include questions about race, gender, ethnicity, and disability. “Apple cannot bar its employees from discussing pay equity as it relates to protected classes,” Vincent P. White, a labor lawyer with White, Hilferty, & Albanese, told The Verge.

When asked for comment, the Apple spokesperson pointed to the company’s business conduct policy, which supports employees’ right to discuss pay and other work-related issues. It reads: “[N]othing in this Policy should be interpreted as being restrictive of your right to speak freely about your wages, hours, or working conditions.” The spokesperson also pointed to the inclusion and diversity page on its website, which says, “Apple has a firm and long‑standing commitment to pay equity. Globally, employees of all genders earn the same when engaging in similar work with comparable experience and performance. In the United States, the same is true for employees of all races and ethnicities.” It’s unclear if Apple shares any additional information with employees regarding pay equity.

Apple has made privacy one of the company’s hallmarks, and internal surveys run by employees themselves are unlikely to pose privacy issues. While the surveys may include questions about personally identifying information, they’re entirely voluntary and give employees access to much the same information—albeit anonymized—that their employers already have on file.

https://arstechnica.com/?p=1786032

The US government has reached a financial settlement with whistleblower Rick Bright, a former health official who detailed the Trump administration’s botched response to the COVID-19 pandemic.

Bright is an immunology expert who led the Biomedical Advanced Research and Development Authority (BARDA) until he says he was forced out of his position in April 2020. We wrote a detailed summary of the whistleblower complaint he filed shortly after.

The US Department of Health and Human Services (HHS) announced its settlement with Bright today. “The agency would like to thank Dr. Bright for his dedicated public service and for the contributions he made to addressing the COVID-19 pandemic while he served as BARDA Director. We wish him well in his new endeavors,” the HHS statement said.

Details of the settlement were not officially released. “But Dr. Bright’s lawyer, Debra S. Katz, said her client had been compensated to the fullest extent allowed by the law,” The New York Times wrote. “She said he will receive back pay, as well as damages to cover the costs of private security and temporary housing that he required after receiving threats. He will also receive compensation, Ms. Katz said, for distress ‘associated with the disparaging comments and threats’ made by administration officials including [President] Trump, who had blasted Dr. Bright on Twitter as a ‘creep’ and a ‘disgruntled employee.'”

Sidelined for prioritizing science

Bright’s complaint last year said the Trump administration’s COVID-19 response was marred by cronyism and denial about the virus’s severity. Bright said he was transferred to the National Institutes of Health (NIH) in a “retaliatory demotion” after he warned about the severity of the pandemic and shortages of medical supplies. Bright also fought the administration’s push for hydroxychloroquine, a malaria drug that Trump repeatedly promoted as a coronavirus treatment despite a lack of evidence that it would be effective.

The whistleblower complaint said:

Dr. Bright was removed as BARDA Director and Deputy Assistant Secretary for Preparedness and Response in the midst of the deadly COVID-19 pandemic because his efforts to prioritize science and safety over political expediency and to expose practices that posed a substantial risk to public health and safety, especially as it applied to chloroquine and hydroxychloroquine, rankled those in the Administration who wished to continue to push this false narrative. Similarly, Dr. Bright clearly earned the enmity of HHS leadership when his communications with members of Congress, certain White House officials, and the press—all whom were, like him, intent on identifying concrete measures to combat this deadly virus—revealed the lax and dismissive attitude HHS leadership exhibited in the face of the deadly threat confronting our country.

Shortly before his dismissal, Bright concluded that “he had exhausted all avenues to alert government officials, who refused to listen or take appropriate action to accurately inform the public” about the risks of chloroquine and hydroxychloroquine and thus leaked details including internal emails to a Reuters journalist. He was removed from his position days after the article published.

“[O]n the very day that [HHS leadership] involuntarily removed Dr. Bright from his position, the US Food and Drug Administration issued a warning that hydroxychloroquine and chloroquine have not been shown to be safe and effective for treating or preventing COVID-19,” Bright’s complaint said.

The World Health Organization says it does not recommend hydroxychloroquine to prevent or treat COVID-19 because of trials showing the drug is not effective against the disease and has side effects including diarrhea, nausea, abdominal pain, drowsiness, headaches, heart rhythm problems, blood and lymph disorders, kidney injury, and liver problems including liver failure.

Even in the years before the pandemic, according to Bright’s complaint, the Trump administration’s HHS leadership “pressured Dr. Bright and BARDA to ignore expert recommendations and instead to award lucrative contracts based on political connections and cronyism.”

Bright told the Times this week that “going through the assault that I experienced from the last administration, going through the public criticism from the White House and HHS leadership when I was just trying to do my job, put a lot of stress on me. They were trying to find anything they could to disparage me and discredit me.”

The allegations that Bright made against the Trump administration are still being investigated by the Office of Special Counsel, the Times wrote.

Bright now planning for future pandemics

Bright has since been hired by the Rockefeller Foundation as its senior VP of pandemic prevention and response. He is leading the group’s “work to collaborate with leading global public health emergency organizations and entities to develop a pandemic prevention institute that aims to avert future pandemics by identifying and responding to the earliest alerts of a disease outbreak and stopping it in the first 100 days,” the foundation said in the March 2021 announcement of his hiring.

Bright testified at a Congressional hearing after he filed the whistleblower complaint. At the hearing, US Rep. Anna Eshoo (D-Calif.) said that “Dr. Bright has filed one of the most specific and troubling whistleblower complaints I have ever seen” and that “he was fired for being right.”

https://arstechnica.com/?p=1785916

For years, employers have used surveillance to keep tabs on their employees on the job. Cameras have watched as workers moved cash in and out of registers, GPS has reported on the movements of employees driving company vehicles, and software has been monitoring people’s work email.

Now, with more work being done remotely, many of those same surveillance tools are entering people’s homes. A marketing company in Minnesota forced employees to install software that would record videos of employee’s screens and even cut their hours if they took a bathroom break that was too long. A New York e-commerce company told employees that they would have to install monitoring software on their personal computers that would log keystrokes and mouse movements—and they’d have to install an app on their phones that would track their movements throughout the workday.

The situation isn’t limited to the US, either. One multinational company appears to be testing the boundaries of what’s an acceptable level of surveillance for remote workers. Teleperformance, one of the world’s largest call center companies, is reportedly requiring some employees to consent to video monitoring in their homes. Employees in Colombia told NBC News that their new contract granted the company the right to use AI-powered cameras to observe and record their workspaces. The contract also requires employees to share biometric data like fingerprints and photos of themselves, and workers have to agree to share data and images that may include children under 18.

Teleperformance employs over 380,000 people in 83 countries to provide call center services for a range of companies, including Amazon, Apple, and Uber. A company spokesperson told NBC  that it is “constantly looking for ways to enhance the Teleperformance Colombia experience for both our employees and our customers, with privacy and respect as key factors in everything we do.”

Amazon and Apple said that they did not ask Teleperformance for this extra monitoring, and an Apple spokesperson said the company forbids video monitoring of employees by suppliers. A recent Apple audit reportedly found Teleperformance in compliance with this requirement.

But Uber apparently requested the ability to monitor some workers. Uber said it wouldn’t observe the entire workforce, but the company did not specify which employees would be subject to the new policies. The ride sharing company asked for the monitoring of Teleperformance’s remote employees because call center staff have access to customers credit cards and trip details, an Uber spokesperson told NBC News.

Like many remote workers in the US, Colombians have had to make do with the space they have available to them. In many cases, that’s meant putting their work equipment in otherwise private spaces like their bedrooms. “The contract allows constant monitoring of what we are doing, but also our family,” one worker told NBC. “I think it’s really bad. We don’t work in an office. I work in my bedroom. I don’t want to have a camera in my bedroom.”

Another Teleperformance worker said the only room quiet enough to take customer calls is her bedroom, and at night, during her shifts, it’s also where her husband sleeps. “It’s a violation of my privacy rights, and the rights of my husband and mother-in-law who live with me,” she said.

Boom time for surveillance

Many companies (though not all) were forced to implement remote work a year and a half ago when the pandemic began, and since then, interest in employee monitoring software has boomed. There’s concern that, when the pandemic ends, digital surveillance will follow employees back to the office.

The tools and policies vary in their degrees of invasiveness. Some monitor which apps or websites are open and active, while others log keystrokes or take screenshots to allow managers to snoop on their employees’ desktops. Some will keep tabs on general activity, posting a pop-up window if the person appears to be inactive for too long. If the user doesn’t dismiss it in time, it’ll pause their time clock, effectively docking their pay if their bathroom break stretches too long. Other employers skip specialized apps entirely and ask their employees to stay on video chat all day long.

Employees don’t have many options. They can organize to push back against snooping employers—which many of Teleperformance’s Colombian employees appear to be doing—but many countries, including the US, don’t have laws to prevent companies from surveilling their workers. While the Fourth Amendment in the US may protect against unreasonable search and seizure by the government, it doesn’t apply to private companies in these cases.

“There’s not a constitutional issue here,” Paul Stephens, director of policy and advocacy with Privacy Rights Clearinghouse, told NPR last year. “There aren’t a whole lot of legal protections for employees who are being monitored.”

https://arstechnica.com/?p=1785847

On Sunday, District Court Judge Kathleen Williams issued a preliminary injunction that blocks the state of Florida from enforcing a law that would have blocked cruise lines from requiring their passengers provide COVID-19 vaccine records.

While this is a temporary injunction that only applies to a single company, the ruling indicates that the law violates two separate constitutional protections, and provides a roadmap for any other company that is interested in contesting it. In addition, the same legal logic may apply to many similar statutes and executive orders adopted elsewhere in the US.

Norwegian vs. the sunshine state

If a Sunday ruling seems unusual, it’s because of the case’s tight timeline. Norwegian Cruise Line Holdings, which runs a number of cruise ships out of Florida, is planning on starting a cruise next weekend. The company has promised its customers that everyone—all fellow passengers and the crew—will have been vaccinated, and the company will confirm their status. While in keeping with CDC guidance and requirements at a number of locations the cruise will visit, that approach runs afoul of Florida law, specifically a statute called Section 381.00316.

That law says a business “may not require patrons or customers to provide any documentation certifying COVID-19 vaccination or post-infection recovery to gain access to, entry upon, or service from the business operations in this state.” Violations could cost Norwegian up to $5,000 per instance. With a ship full of passengers, that could add up fast.

So, the company sued Florida and asked for a preliminary injunction to block enforcement of the law until the full case can be heard. In order to receive one, Norwegian had to show two things: that it was likely to prevail when the case goes to trial, and that it would suffer irreparable harm if the law was enforced against it in the meantime.

With a cruise nearly set to depart, the “irreparable harm” aspect of the case would seem to be relatively simple. As the judge noted, the company guaranteed its customers a cruise with enhanced safety due to total vaccination. If it can’t deliver or starts the cruise only to have an outbreak occur onboard, the company’s reputation may suffer lasting damage that goes well beyond this one set of passengers. The alternative of not starting cruises at all has already cost the company $6 billion.

Vaccination records as speech

Norwegian made two legal arguments about why the law was invalid, both focusing on constitutional issues: the First Amendment right to free speech, and the clause of the Constitution that prevents states from interfering with interstate commerce. Judge Williams found that the company is likely to prevail on both of these arguments.

The attorneys representing Florida argued that Section 381.00316 is simply an economic regulation, and so it shouldn’t be subject to First Amendment review. But the court didn’t consider that persuasive, finding that communicating vaccination status is a form of speech. In addition, the ruling noted that Florida’s statute allowed vaccine status to be communicated as long as it wasn’t done via formal documents, and for Norwegian to ask for vaccine documentation for many other illnesses. Thus, Section 381.00316 regulates the content and form of speech. And, as Judge Williams writes, “It is well-established that a law may constitute a speech-based restriction by burdening or limiting speech on a particular topic.”

Based on Supreme Court precedent, that’s still acceptable if the infringement of speech called for by Florida were incidental to the goals of the regulation. But for Section 381.00316, limiting the content of the speech is the entire point of the law.

Florida attempted to provide two justifications for the restriction on speech: avoiding discrimination against the unvaccinated, and protecting medical privacy. But the state presented no evidence that these were actual problems its citizens were facing. The ruling suggests that, if discrimination were a real issue, then the state wouldn’t allow vaccine status to be conveyed through other means, or to allow Norwegian to require that its crew be vaccinated. Both of these could still allow the loss of medical privacy, as would the huge numbers of COVID tests that might be needed if vaccinations aren’t used to control the virus.

So, in sum, the court found Florida’s justification for the law feeble and poorly supported, and it saw clear First Amendment issues. “There is no evidence in the record to demonstrate that Florida considered obvious, alternative policies that could advance the stated objectives without restricting speech,” Williams concluded.

Unconstitutional not once, but twice

The other issue at play is the Interstate Commerce Clause of the Constitution, which gives the federal government the right to regulate commerce among states and between the US and foreign countries and prohibits the states from interfering with that. Given that Norwegain’s cruise has an itinerary that includes visiting ports in US territories and foreign countries, it definitely includes aspects that fall under this clause.

Beyond that generality, Norwegian has made an agreement with the CDC in order to have approval to restart its cruise business that included vaccination plans. Many of the locations its cruises will be visiting also have entry requirements that include vaccination as an alternative to lengthy quarantines. So there are specific aspects of Norwegian’s national and international business that Section 381.00316 would interfere with.

That can still be constitutional if the law were to provide in-state benefits that outweighed the interference. But, as noted above, Williams was not persuaded that the Section 381.00316 provided any benefits, and the judge specifically indicated that the purported benefits offered by the state weren’t legitimate, as described just above.

Big implications

As currently written, the decision applies to this one Florida law and only in regards to its enforcement against a single company. But it’s difficult to ignore that Williams has outlined major constitutional issues that are likely to be applicable to any of the growing number of laws passed by a variety of states. In describing her application of relevant precedents, the judge provided any other company or institution that wanted to challenge these laws with a roadmap on how to do so.

That doesn’t mean that a better prepared team of state attorneys couldn’t identify other precedents that might be construed as supporting these laws. But they’re all going to be faced with the same difficulties that Florida’s attorney’s faced: the laws are pretty much impossible to defend by claiming they provide a benefit to the state’s occupants, and there are many precedents for requiring vaccine records in other contexts.

https://arstechnica.com/?p=1785844

Apple today said it will refuse any government demands to expand its new photo-scanning technology beyond the current plan of using it only to detect CSAM (child sexual abuse material).

Apple has faced days of criticism from security experts, privacy advocates, and privacy-minded users over the plan it announced Thursday, in which iPhones and other Apple devices will scan photos before they are uploaded to iCloud. Many critics pointed out that once the technology is on consumer devices, it won’t be difficult for Apple to expand it beyond the detection of CSAM in response to government demands for broader surveillance. We covered how the program will work in detail in an article Thursday night.

Governments have been pressuring Apple to install backdoors into its end-to-end encryption system for years, and Apple acknowledged that governments are likely to make the exact demands that security experts and privacy advocates have been warning about. In a FAQ released today with the title, “Expanded Protections for Children,” there is a question that asks, “Could governments force Apple to add non-CSAM images to the hash list?”

Apple answers the question as follows:

Apple will refuse any such demands. Apple’s CSAM detection capability is built solely to detect known CSAM images stored in iCloud Photos that have been identified by experts at NCMEC (National Center for Missing and Exploited Children) and other child safety groups. We have faced demands to build and deploy government-mandated changes that degrade the privacy of users before, and have steadfastly refused those demands. We will continue to refuse them in the future. Let us be clear, this technology is limited to detecting CSAM stored in iCloud and we will not accede to any government’s request to expand it. Furthermore, Apple conducts human review before making a report to NCMEC. In a case where the system flags photos that do not match known CSAM images, the account would not be disabled and no report would be filed to NCMEC.

None of this means that Apple lacks the ability to expand the technology’s uses, of course. Answering the question of whether its photo-scanning system can be used to detect things other than CSAM, Apple said that it “is designed to prevent that from happening.”

“CSAM detection for iCloud Photos is built so that the system only works with CSAM image hashes provided by NCMEC and other child safety organizations,” Apple said. “There is no automated reporting to law enforcement, and Apple conducts human review before making a report to NCMEC. As a result, the system is only designed to report photos that are known CSAM in iCloud Photos.”

Apple says it won’t inject other photos into database

But the system’s current design doesn’t prevent it from being redesigned and used for other purposes in the future. The new photo-scanning technology itself is a major change for a company that has used privacy as a selling point for years and calls privacy a “fundamental human right.”

Apple said the new system will be rolled out later this year in updates to iOS 15, iPadOS 15, watchOS 8, and macOS Monterey, and will initially be deployed in the US only. The current plan is for Apple devices to scan user photos and report those that match a database of known CSAM image hashes. The Apple FAQ implicitly acknowledges that hashes of other types of images could be added to the list, but the document says Apple won’t do that.

“Can non-CSAM images be ‘injected’ into the system to flag accounts for things other than CSAM? Our process is designed to prevent that from happening,” Apple wrote. “The set of image hashes used for matching are from known, existing images of CSAM that have been acquired and validated by child safety organizations. Apple does not add to the set of known CSAM image hashes.”

Apple also said the new “feature only impacts users who have chosen to use iCloud Photos to store their photos. It does not impact users who have not chosen to use iCloud Photos.” Apple’s FAQ didn’t say how many people use iCloud Photos, but it is a widely used feature. There are over 1 billion iPhones actively used worldwide, and a 2018 estimate by Barclays analysts found that iCloud (including all services, not just iCloud Photos) had 850 million users.

Apple memo called privacy advocates “screeching voices”

Apple does not seem to have anticipated the level of criticism its decision to scan user photos would receive. On Thursday night, Apple distributed an internal memo that acknowledged criticism but dismissed it as “screeching voices of the minority.”

That portion of the memo was written by NCMEC Executive Director of Strategic Partnerships Marita Rodriguez. “I know it’s been a long day and that many of you probably haven’t slept in 24 hours. We know that the days to come will be filled with the screeching voices of the minority. Our voices will be louder. Our commitment to lift up kids who have lived through the most unimaginable abuse and victimizations will be stronger,” Rodriguez wrote.

The memo was obtained and published by 9to5Mac. The Apple-written portion of the memo said, “We’ve seen many positive responses today. We know some people have misunderstandings, and more than a few are worried about the implications, but we will continue to explain and detail the features so people understand what we’ve built.”

Open letter warns of expanding surveillance uses

Over 6,000 people signed an open letter urging Apple to reverse course, saying, “Apple’s current path threatens to undermine decades of work by technologists, academics and policy advocates towards strong privacy-preserving measures being the norm across a majority of consumer electronic devices and use cases.”

The letter quoted several security experts, including researcher Nadim Kobeissi, who wrote, “Reminder: Apple sells iPhones without FaceTime in Saudi Arabia, because local regulation prohibits encrypted phone calls. That’s just one example of many where Apple’s bent to local pressure. What happens when local regulation mandates that messages be scanned for homosexuality?”

The letter also quotes Johns Hopkins University cryptography professor Matthew Green, who told Wired, “The pressure is going to come from the UK, from the US, from India, from China. I’m terrified about what that’s going to look like. Why would Apple want to tell the world, ‘Hey, we’ve got this tool’?”

https://arstechnica.com/?p=1785740

When Facebook disabled the accounts of New York University researchers who were investigating misinformation and political ads on the platform, the social-media giant claimed it did so to comply with a consent decree that it previously agreed to with the Federal Trade Commission. “We took these actions to stop unauthorized scraping and protect people’s privacy in line with our privacy program under the FTC Order,” Facebook wrote in its explanation of the account suspensions. Facebook said it “disabled the accounts, apps, Pages and platform access associated with NYU’s Ad Observatory Project and its operators.”

But Facebook’s claim that the FTC order forced it to suspend the researchers is false, FTC Bureau of Consumer Protection Acting Director Samuel Levine wrote in a letter to Facebook CEO Mark Zuckerberg on Thursday. The FTC order did require Facebook to create a privacy program, but there was no requirement that would have forced Facebook to shut down the NYU research project. Despite that, Facebook’s statement that it suspended the accounts “in line with our privacy program under the FTC Order” conveys the false message that Facebook had no choice in the matter.

Levine’s three-paragraph letter to Zuckerberg said:

I write concerning Facebook’s recent insinuation that its actions against an academic research project conducted by NYU’s Ad Observatory were required by the company’s consent decree with the Federal Trade Commission. As the company has since acknowledged, this is inaccurate. The FTC is committed to protecting the privacy of people, and efforts to shield targeted advertising practices from scrutiny run counter to that mission.

While I appreciate that Facebook has now corrected the record, I am disappointed by how your company has conducted itself in this matter. Only last week, Facebook’s General Counsel, Jennifer Newstead, committed the company to “timely, transparent communication to BCP staff about significant developments.” Yet the FTC received no notice that Facebook would be publicly invoking our consent decree to justify terminating academic research earlier this week.

Had you honored your commitment to contact us in advance, we would have pointed out that the consent decree does not bar Facebook from creating exceptions for good-faith research in the public interest. Indeed, the FTC supports efforts to shed light on opaque business practices, especially around surveillance-based advertising. While it is not our role to resolve individual disputes between Facebook and third parties, we hope that the company is not invoking privacy—much less the FTC consent order—as a pretext to advance other aims.

Facebook “cynically invoke[d] user privacy”

On Tuesday, “Facebook abruptly shut down the accounts of New York University researchers Laura Edelson and Damon McCoy, blocking their research into political ads and the spread of misinformation on the platform,” wrote the Knight First Amendment Institute at Columbia University, which is representing Edelson and McCoy in the matter.

Edelson and McCoy researched Facebook using Ad Observer, “a browser plugin they and others created that allows consenting Facebook users to voluntarily share with the researchers limited and anonymous information about the political ads shown to them by the platform.”

Facebook’s action cut off the access that the researchers used “to uncover systemic flaws in the Facebook Ad Library, to identify misinformation in political ads, including many sowing distrust in our election system, and to study Facebook’s apparent amplification of partisan misinformation,” Edelson said. “By suspending our accounts, Facebook has tried to shut down all this work.” Edelson said that “Facebook suspended my Facebook account and the accounts of several people associated with Cybersecurity for Democracy, our team at NYU.”

McCoy said that “Facebook should not be able to cynically invoke user privacy to shut down research that puts them in an unflattering light, particularly when the ‘users’ Facebook is talking about are advertisers who have consented to making their ads public.”

“It is disgraceful that Facebook is attempting to squash legitimate research that is informing the public about disinformation on their platform. With its platform awash in vaccine disinformation and partisan campaigns to manipulate the public, Facebook should be welcoming independent research, not shutting it down,” McCoy also said.

The FTC website states that in 2019, Facebook agreed to a $5 billion settlement with the commission “related to allegations that the company violated its 2012 FTC privacy order by deceiving users about their ability to control the privacy of their personal information.” Facebook had to pay the penalty and change its privacy practices. The settlement resulted largely from Facebook allowing third-party app developers to access data about users’ friends in the Cambridge Analytica scandal.

Researchers deny Facebook claims

When suspending the NYU researchers, Facebook said the Ad Observer browser extension “was programmed to evade our detection systems and scrape data such as usernames, ads, links to user profiles and ‘Why am I seeing this ad?’ information, some of which is not publicly viewable on Facebook. The extension also collected data about Facebook users who did not install it or consent to the collection.”

The researchers deny this, with Edelman telling NPR, “We really don’t collect anything that isn’t an ad, that isn’t public, and we’re pretty careful about how we do it.”

The Ad Observer website says the browser extension does not collect any personally identifying information. “It copies the ads you see on Facebook and YouTube, so anyone can see them in our public database,” the site says. “If you want, you can enter basic demographic information about yourself in the tool to help improve our understanding of why advertisers targeted you.”

This is important because “ads are usually seen only by the audience the advertiser wants to target, and then they disappear,” making it “difficult for the public to monitor them and hold advertisers accountable,” the project says.

Facebook’s FTC fights

The new dispute comes a few weeks after Facebook petitioned the FTC to remove Chair Lina Khan from an antitrust case against the company. Amazon previously filed a similar recusal petition, but neither company has identified a conflict of interest in the usual sense that would require Khan to recuse herself. They simply object to statements about competition and criticisms of the companies that Khan made before becoming FTC chair.

A group of senators led by Elizabeth Warren (D-Mass.) on Wednesday told both companies, “There is no basis for her recusal under the current federal ethics statute or FTC precedent. Your efforts to sideline Chair Khan appear to be nothing more than attempts to force an FTC stalemate that would allow you to evade accountability for any anti-competitive behavior.”

Facebook admits truth to Wired

Facebook said it imposed the suspensions about a year after it first told the researchers that their extension would violate Facebook’s Terms of Service. As Wired wrote Wednesday, Facebook’s claim that the FTC order forced its hand doesn’t add up “because the consent decree doesn’t prohibit what the researchers have been doing.” Facebook admitted that in a response to Wired, the article said:

Joe Osborne, a Facebook spokesperson, acknowledges that the consent decree didn’t force Facebook to suspend the researchers’ accounts. Rather, he says, Section 7 of the decree requires Facebook to implement a “comprehensive privacy program” that “protects the privacy, confidentiality, and integrity” of user data. It’s Facebook’s privacy program, not the consent decree itself, that prohibits what the Ad Observer team has been doing. Specifically, Osborne says, the researchers repeatedly violated a section of Facebook’s terms of service that provides, “You may not access or collect data from our Products using automated means (without our prior permission).” The blog post announcing the account bans mentions scraping 10 times.

Despite that admission, Facebook’s blog post still contained the statement that Facebook suspended the researchers to “protect people’s privacy in line with our privacy program under the FTC Order.”

We asked Facebook why it hasn’t changed or deleted that sentence. A Facebook spokesperson responded to our email but did not answer the question.

https://arstechnica.com/?p=1785528

Shortly after reports today that Apple will start scanning iPhones for child-abuse images, the company confirmed its plan and provided details in a news release and technical summary.

“Apple’s method of detecting known CSAM (child sexual abuse material) is designed with user privacy in mind,” Apple’s announcement said. “Instead of scanning images in the cloud, the system performs on-device matching using a database of known CSAM image hashes provided by NCMEC (National Center for Missing and Exploited Children) and other child safety organizations. Apple further transforms this database into an unreadable set of hashes that is securely stored on users’ devices.”

Apple provided more detail on the CSAM detection system in a technical summary and said its system uses a threshold “set to provide an extremely high level of accuracy and ensures less than a one in one trillion chance per year of incorrectly flagging a given account.”

The changes will roll out “later this year in updates to iOS 15, iPadOS 15, watchOS 8, and macOS Monterey,” Apple said. Apple will also deploy software that can analyze images in the Messages application for a new system that will “warn children and their parents when receiving or sending sexually explicit photos.”

Apple accused of building “infrastructure for surveillance”

Despite Apple’s assurances, security experts and privacy advocates criticized the plan.

“Apple is replacing its industry-standard end-to-end encrypted messaging system with an infrastructure for surveillance and censorship, which will be vulnerable to abuse and scope-creep not only in the US, but around the world,” said Greg Nojeim, co-director of the Center for Democracy & Technology’s Security & Surveillance Project. “Apple should abandon these changes and restore its users’ faith in the security and integrity of their data on Apple devices and services.”

For years, Apple has resisted pressure from the US government to install a “backdoor” in its encryption systems, saying that doing so would undermine security for all users. Apple has been lauded by security experts for this stance. But with its plan to deploy software that performs on-device scanning and share selected results with authorities, Apple is coming dangerously close to acting as a tool for government surveillance, Johns Hopkins University cryptography Professor Matthew Green suggested on Twitter.

The client-side scanning Apple announced today could eventually “be a key ingredient in adding surveillance to encrypted messaging systems,” he wrote. “The ability to add scanning systems like this to E2E [end-to-end encrypted] messaging systems has been a major ‘ask’ by law enforcement the world over.”

Message scanning and Siri “intervention”

In addition to scanning devices for images that match the CSAM database, Apple said it will update the Messages app to “add new tools to warn children and their parents when receiving or sending sexually explicit photos.”

“Messages uses on-device machine learning to analyze image attachments and determine if a photo is sexually explicit. The feature is designed so that Apple does not get access to the messages,” Apple said.

When an image in Messages is flagged, “the photo will be blurred and the child will be warned, presented with helpful resources, and reassured it is okay if they do not want to view this photo.” The system will let parents get a message if children do view a flagged photo, and “similar protections are available if a child attempts to send sexually explicit photos. The child will be warned before the photo is sent, and the parents can receive a message if the child chooses to send it,” Apple said.

Apple said it will update Siri and Search to “provide parents and children expanded information and help if they encounter unsafe situations.” The Siri and Search systems will “intervene when users perform searches for queries related to CSAM” and “explain to users that interest in this topic is harmful and problematic, and provide resources from partners to get help with this issue.”

The Center for Democracy & Technology called the photo-scanning in Messages a “backdoor,” writing:

The mechanism that will enable Apple to scan images in Messages is not an alternative to a backdoor—it is a backdoor. Client-side scanning on one “end” of the communication breaks the security of the transmission, and informing a third party (the parent) about the content of the communication undermines its privacy. Organizations around the world have cautioned against client-side scanning because it could be used as a way for governments and companies to police the content of private communications.

Apple’s technology for analyzing images

Apple’s technical summary on CSAM detection includes a few privacy promises in the introduction. “Apple does not learn anything about images that do not match the known CSAM database,” it says. “Apple can’t access metadata or visual derivatives for matched CSAM images until a threshold of matches is exceeded for an iCloud Photos account.”

Apple’s hashing technology is called NeuralHash, and it “analyzes an image and converts it to a unique number specific to that image. Only another image that appears nearly identical can produce the same number; for example, images that differ in size or transcoded quality will still have the same NeuralHash value,” Apple wrote.

Before an iPhone or other Apple device uploads an image to iCloud, the “device creates a cryptographic safety voucher that encodes the match result. It also encrypts the image’s NeuralHash and a visual derivative. This voucher is uploaded to iCloud Photos along with the image.”

Using “threshold secret sharing,” Apple’s “system ensures that the contents of the safety vouchers cannot be interpreted by Apple unless the iCloud Photos account crosses a threshold of known CSAM content,” the document said. “Only when the threshold is exceeded does the cryptographic technology allow Apple to interpret the contents of the safety vouchers associated with the matching CSAM images.”

While noting the 1-in-1 trillion probability of a false positive, Apple said it “manually reviews all reports made to NCMEC to ensure reporting accuracy.” Users can “file an appeal to have their account reinstated” if they believe their account was mistakenly flagged.

User devices to store blinded CSAM database

User devices will store a “blinded database” that allows the device to determine when a photo matches a picture in the CSAM database, Apple explained:

First, Apple receives the NeuralHashes corresponding to known CSAM from the above child-safety organizations. Next, these NeuralHashes go through a series of transformations that includes a final blinding step, powered by elliptic curve cryptography. The blinding is done using a server-side blinding secret, known only to Apple. The blinded CSAM hashes are placed in a hash table, where the position in the hash table is purely a function of the NeuralHash of the CSAM image. This blinded database is securely stored on users’ devices. The properties of elliptic curve cryptography ensure that no device can infer anything about the underlying CSAM image hashes from the blinded database.

An iPhone or other device will analyze user photos, compute a NeuralHash, and look up “the entry in the blinded hash table.” The device “also uses the blinded hash that the system looked up to obtain a derived encryption key” and uses that encryption key “to encrypt the associated payload data.”

Combined with other steps, this ensures that only images matching the CSAM database will be decrypted, Apple wrote:

If the user image hash matches the entry in the known CSAM hash list, then the NeuralHash of the user image exactly transforms to the blinded hash if it went through the series of transformations done at database setup time. Based on this property, the server will be able to use the cryptographic header (derived from the NeuralHash) and using the server-side secret, can compute the derived encryption key and successfully decrypt the associated payload data.

If the user image doesn’t match, the above step will not lead to the correct derived encryption key, and the server will be unable to decrypt the associated payload data. The server thus learns nothing about non-matching images.

The device doesn’t learn about the result of the match because that requires knowledge of the server-side blinding secret.

Finally, the client uploads the image to the server along with the voucher that contains the encrypted payload data and the cryptographic header.

As noted earlier, you can read the technical summary here. Apple also published a longer and more detailed explanation of the “private set intersection” cryptographic technology that determines whether a photo matches the CSAM database without revealing the result.

https://arstechnica.com/?p=1785443

CenturyLink is selling large portions of its copper network in 20 states to a private-equity firm, letting the telco pull out of rural areas where it doesn’t plan to install fiber-to-the-home technology. CenturyLink agreed to sell the networks for $7.5 billion to Apollo Funds, a private-equity fund operated by Apollo Global Management. Apollo will also take $1.4 billion of debt off CenturyLink’s hands.

Under the deal expected to close in the second half of 2022, Apollo will acquire the CenturyLink ILEC (Incumbent Local Exchange Carrier) business in the 20 states, including “consumer, small business, wholesale, and mostly copper-served enterprise customers and assets,” a press release said yesterday. The networks in the pending sale reach seven million residences and businesses but only have 200,000 fiber-to-the-premises deployments.

CenturyLink said it will keep its ILEC networks in 16 states where it has 2.4 million fiber-to-the-premises deployments among 21 million homes and businesses, saying these networks have “significant overlap” with its “enterprise and fiber-to-the-home build opportunities.”

CenturyLink recently renamed itself “Lumen” but still uses the CenturyLink brand name for residential and small-business customers while using the Lumen brand for enterprise customers.

Homes languish on old copper lines

“On a conference call with investors, Lumen CEO Jeff Storey said that 70 percent of the markets that Lumen will retain in the deal are in urban and suburban areas and that those are the types of markets in which Lumen was most likely to invest in upgrading broadband service to its fiber-based offering known as Quantum,” Telecompetitor wrote.

In the states where CenturyLink networks are being sold, Storey said, “we knew that we were unlikely to prioritize investment in these markets ahead of our other opportunities in enterprise and Quantum fiber.” The networks in the pending sale have 1.3 million CenturyLink Internet subscribers, nearly all on copper-based DSL. About 59,000 of those subscribers are on fiber.

Apollo will also be serving CenturyLink landline phone customers. CenturyLink stopped reporting the number of telephone subscribers it has a few years ago, but the company had 10.3 million phone access lines at the end of 2017. More recently, the “voice and other” category accounted for $518 million of the $1.4 billion revenue in the company’s mass-market category in Q2 2021. Including residential and business segments, the company’s voice services made $1.5 billion of the total $4.9 billion in quarterly revenue. The rest is from consumer broadband, business IP and data services, compute and application services, and fiber infrastructure services.

Where the networks are

The networks being sold operate under the CenturyLink name and are in Alabama, Arkansas, Georgia, Illinois, Indiana, Kansas, Louisiana, Michigan, Mississippi, Missouri, New Jersey, North Carolina, Ohio, Oklahoma, Pennsylvania, South Carolina, Tennessee, Texas, Virginia, and Wisconsin.

CenturyLink/Lumen operates both ILECs and CLECs (Competitive Local Exchange Carriers), the latter of which generally lease lines from incumbents instead of deploying their own. The company will keep the CLECs in all 36 states it operates in and will keep the ILECs in Arizona, Colorado, Florida, Idaho, Iowa, Minnesota, Montana, Nebraska, Nevada, New Mexico, North Dakota, Oregon, South Dakota, Utah, Washington, and Wyoming. CenturyLink/Lumen “will retain 3.4 million broadband subscribers, including 687,000 fiber subscribers,” Telecompetitor wrote.

Apollo promises fiber upgrades

The sale could continue a long-term trend of DSL customers in rural areas being denied fiber upgrades while old copper networks fall into disrepair. CenturyLink won’t be likely to upgrade networks that it’s already agreed to sell but will continue to operate them for another year. How much fiber deployment Apollo will undertake isn’t clear, but the company said the firm’s investment “will help accelerate the upgrade to fiber optic technologies, bringing faster and more reliable Internet service to many rural markets traditionally underserved by broadband providers, while delivering best-in-class customer service.”

CenturyLink/Lumen has focused more heavily on serving large businesses in recent years, a strategy fueled in part by its 2017 acquisition of Level 3.

https://arstechnica.com/?p=1785119

Cybersecurity at eight federal agencies is so poor that four of them earned grades of D, three got Cs, and only one received a B in a report issued Tuesday by a US Senate Committee.

“It is clear that the data entrusted to these eight key agencies remains at risk,” the 47-page report stated. “As hackers, both state-sponsored and otherwise, become increasingly sophisticated and persistent, Congress and the executive branch cannot continue to allow PII and national security secrets to remain vulnerable.”

The report, issued by the Senate Committee on Homeland Security and Governmental Affairs, comes two years after a separate report found systemic failures by the same eight federal agencies in complying with federal cybersecurity standards. The earlier report found that during the decade spanning 2008 to 2018, the agencies failed to properly protect personally identifiable information, maintain a list of all hardware and software used on agency networks, and install vendor-supplied security patches in a timely manner.

The 2019 report also highlighted that the agencies were operating legacy systems that were costly to maintain and hard to secure. All eight agencies—including the Social Security Administration and the Departments of Homeland Security, State, Transportation, Housing and Urban Development, Agriculture, Health and Human Services, and Education—failed to protect sensitive information they stored or maintained.

Tuesday’s report, titled Federal Cybersecurity: America’s Data Still at Risk, analyzed security practices by the same agencies for 2020. It found that only one agency had earned a grade of B for its cybersecurity practices last year.

“What this report finds is stark,” the authors wrote. “Inspectors general identified many of the same issues that have plagued Federal agencies for more than a decade. Seven agencies made minimal improvements, and only DHS managed to employ an effective cybersecurity regime for 2020. As such, this report finds that these seven Federal agencies still have not met the basic cybersecurity standards necessary to protect America’s sensitive data.”

The authors assigned the following grades:

State Department systems, the auditors found, frequently operated without the required authorizations, ran software (including Microsoft Windows) that was no longer supported, and failed to install security patches in a timely manner.

The department’s user management system came under particular criticism because officials couldn’t provide documentation of user access agreements for 60 percent of sample employees that had access to the department’s classified network.

The auditors wrote:

This network contains data which if disclosed to an unauthorized person could cause “grave damage” to national security. Perhaps more troubling, State failed to shut off thousands of accounts after extended periods of inactivity on both its classified and sensitive but unclassified networks. According to the Inspector General, some accounts remained active as long as 152 days after employees quit, retired, or were fired. Former employees or hackers could use those unexpired credentials to gain access to State’s sensitive and classified information, while appearing to be an authorized user. The Inspector General warned that without resolving issues in this category, “the risk of unauthorized access is significantly increased.”

The Social Security Administration, meanwhile, suffered many of the same shortcomings, including a lack of authorization for many systems, use of unsupported systems, failure to Compile an Accurate and Comprehensive IT Asset Inventory, and Failure to Provide for the Adequate Protection of PII.

Details about the other departments are available in the report linked earlier.

The report comes seven months after the discovery of a supply chain attack that led to the compromise of nine federal agencies and about 100 private companies. In April, hackers working on behalf of the Chinese government breached multiple federal agencies by exploiting vulnerabilities in the Pulse Secure VPN.

For all of 2020, the White House reported 30,819 information security incidents across the federal government, an 8 percent increase from the prior year.

https://arstechnica.com/?p=1784956

Amazon interfered with a union-certification vote, and a second election should be held, a National Labor Relations Board (NLRB) official wrote in a report released yesterday. Amazon’s anti-union misconduct made a “free and fair election… impossible,” the report said.

A majority of Amazon workers at a fulfillment center in Bessemer, Alabama, voted against certifying a union in April. The Retail, Wholesale, and Department Store Union subsequently filed a complaint with the NLRB and was able to convince the hearing officer that Amazon interfered with the election.

“[T]he evidence demonstrates that the employer’s conduct interfered with the laboratory conditions necessary to conduct a fair election,” NLRB attorney and hearing officer Kerstin Meyers wrote. The report continued:

More specifically, the conduct which interfered with the result of the election relates to the employer’s polling of employees by distribution of “vote no” paraphernalia in the presence of supervisors and managers, as well as the employer’s unilateral decision to cause the United States Postal Service to install a generic unlabeled mail collection box less than 50 feet from the main entrance to its facility, at a location suggested by the employer and immediately beneath the visible surveillance cameras mounted on the employer’s main entrance. While this is a case of first impression, the employer’s conduct in causing this generic mail receptacle to be installed usurped the National Labor Relations Board’s exclusive role in administering union elections. Notwithstanding the union’s substantial margin of defeat, the employer’s unilateral decision to create, for all intents and purposes, an onsite collection box for NLRB ballots destroyed the laboratory conditions and justifies a second election.

Amazon to appeal

The ruling is not final, so a second election is not yet definite. The NLRB process allows appeals and will give Amazon several “opportunities for delay” even though its mailbox-related conduct was “pretty egregious,” University of North Carolina professor of labor and employment law Jeff Hirsch wrote in a Twitter thread yesterday. “The next step is for the hearing officer’s recommendation to be reviewed by the head of the Atlanta Region,” he wrote. The regional director could order a new election, and Amazon has already said it will appeal.

“Our employees had a chance to be heard during a noisy time when all types of voices were weighing into the national debate, and at the end of the day, they voted overwhelmingly in favor of a direct connection with their managers and the company. Their voice should be heard above all else, and we plan to appeal to ensure that happens,” Amazon said in a statement issued yesterday.

Before the regional director weighs in, the parties have until August 16 to file objections to the NLRB hearing officer’s report. Though it was a good result for the union, the NLRB official rejected some of the union’s claims. For example, the union objected to Amazon’s hiring of additional police, but there was “no evidence that any of the police officers engaged in activity related to the election or the union’s campaign or otherwise engaged in conduct intended to intimidate voters,” Meyers wrote.

The results were 1,798 votes against certifying the union and 738 for the union. There were also “505 challenged ballots, a number that was not sufficient to affect the results of the election,” Meyers noted. Over 2,000 employees did not vote, and Meyers wrote that it is possible they were “influenced” by Amazon’s misconduct.

“Free and fair election was impossible”

Meyers found that Amazon’s installation of a mailbox “at a location that reasonably appeared to be within the viewing field of the employer’s multiple security surveillance cameras… so tainted the election that a second election is necessary.” It was “clear that Amazon, not USPS,” chose the site of the mailbox, the report said.

The NLRB “safeguards the administration of elections and does not delegate any functions to the parties,” and “the mere appearance that a party has control over the election… destroys the laboratory conditions necessary to conduct an election,” Meyers wrote.

Meyers’ recommendation to rerun the election “is based upon the manner in which the mail receptacle was installed that created the impression that the employer could unilaterally establish procedures for the election and cast doubt on the [NLRB’s] authority and control over the election procedures,” she wrote, continuing:

The situs of the CBU [USPS cluster box unit] created the impression that the employer was surveilling employees’ Section 7 [organizing] activities, and the inclusion of the employer’s campaign propaganda on the tent leading to the [mailbox] further instilled the impression that the employer had created its own voting location without any authorization from the board. By manufacturing a situation that created the impression that the board had, either voluntarily or involuntarily, ceded its authority for collecting ballots and establishing procedures for conducting the election, the employer interfered with the election proceedings. Under the circumstances, where the authority of the board was compromised by the conduct of a party, and that same conduct impacted employees and was coupled with other transgressions that interfered with employee free choice, a free and fair election was impossible. Under the circumstances, I recommend that a second election be ordered.

Anti-union materials

Meyers also wrote that Amazon “committed objectionable conduct” by distributing “anti-union materials in the presence of managers.”

“[T]he misconduct herein occurred on numerous occasions at untold number of meetings,” Meyers wrote. “Virtually all of the bargaining unit employees were subjected to the misconduct, as these were mandatory employee meetings.”

“[T]he materials were placed in plain view of the managers, such that employees were forced to make a discernible choice to retrieve the materials, or not, under the observation of employee relations and human resources managers,” Meyers also wrote. Whether Amazon tracked which employees took the materials is not relevant to the question of “whether its conduct could reasonably cause an employee to perceive that the employer was trying to discern their support for, or against, the union—as it is the act of attempting to discern employee support that ‘tends to cause fear of reprisal in the mind of employees… and, therefore tends to impinge his Section 7 rights,'” Meyers wrote.

The large margin of the vote is not a reason to stick with the results of the first election, Meyers wrote. The report said:

Over 2,000 employees did not vote in the election, a sufficient number to affect the results of the election. While it is unknown why these employees refrained from voting, there is, at the very least, the possibility that the employer’s misconduct influenced some of these 2,000 eligible voters.

https://arstechnica.com/?p=1784889