Zoom has agreed to pay $85 million to settle claims that it lied about offering end-to-end encryption and gave user data to Facebook and Google without the consent of users. The settlement between Zoom and the filers of a class-action lawsuit also covers security problems that led to rampant “Zoombombings.”

The proposed settlement would generally give Zoom users $15 or $25 each and was filed Saturday at US District Court for the Northern District of California. It came nine months after Zoom agreed to security improvements and a “prohibition on privacy and security misrepresentations” in a settlement with the Federal Trade Commission, but the FTC settlement didn’t include compensation for users.

As we wrote in November, the FTC said that Zoom claimed it offers end-to-end encryption in its June 2016 and July 2017 HIPAA compliance guides, in a January 2019 white paper, in an April 2017 blog post, and in direct responses to inquiries from customers and potential customers. In reality, “Zoom did not provide end-to-end encryption for any Zoom Meeting that was conducted outside of Zoom’s ‘Connecter’ product (which are hosted on a customer’s own servers), because Zoom’s servers—including some located in China—maintain the cryptographic keys that would allow Zoom to access the content of its customers’ Zoom Meetings,” the FTC said. In real end-to-end encryption, only the users themselves have access to the keys needed to decrypt content.

The new class-action settlement applies to Zoom users nationwide, regardless of whether they used Zoom for free or paid for an account. If the settlement is approved by the court, “class members who paid for an account will be eligible to receive 15 percent of the money they paid to Zoom for their core Zoom Meetings subscription during that time [March 30, 2016, to July 30, 2021] or $25, whichever is greater,” the settlement said. “Class members who are not eligible to submit a Paid Subscription Claim may make a claim for $15. These amounts may be adjusted, pro rata, up or down, depending on claim volume, the amount of any fee and expense award, service payments to class representatives, taxes and tax expenses, and settlement administration expenses.”

The class lawyers would get attorneys’ fees of up to 25 percent of the $85 million and up to $200,000 for reimbursement of expenses. About a dozen named plaintiffs are seeking approval of payments of $5,000 each. A hearing on the plaintiffs’ motion for preliminary approval of the settlement is scheduled for October 21, 2021.

In addition to payments, Zoom “agreed to over a dozen major changes to its practices, designed to improve meeting security, bolster privacy disclosures, and safeguard consumer data,” the settlement said.

With the pandemic boosting its videoconferencing business, Zoom more than quadrupled its annual revenue from $622.7 million to $2.7 billion in the 12 months ending January 31, 2021. Zoom also reported $672 million in net income for the 12-month period, up from $25.3 million the previous year. Zoom is on pace for even better results this year, having reported Q1 (February-April) revenue of $956.2 million and net income of $227.5 million.

Zoom can’t redefine end-to-end encryption

An amended class-action complaint filed in May 2021 said that, despite Zoom’s false promises of end-to-end (E2E) encryption, “the encryption keys for each meeting are generated by Zoom’s servers, not by the client devices.”

It continued:

The connection between the Zoom app running on a user’s computer or phone and Zoom’s server is encrypted in the same way the connection between a web browser and a website is encrypted. This is known as transport encryption, which is different from end-to-end encryption because the Zoom service itself can access the unencrypted video and audio content of Zoom meetings. In a Zoom meeting utilizing this encryption technology, the video and audio content will stay private from anyone spying on Wi-Fi, but will not stay private from the company or, presumably, anyone with whom the company shares its access voluntarily, by compulsion of law (e.g., at the request of law enforcement), or involuntarily (e.g., a hacker who can infiltrate the company’s systems). With true E2E encryption, the encryption keys are generated by the client (customer) devices, and only the participants in the meeting have the ability to decrypt it.

Zoom’s website claimed that its service lets a host “[s]ecure a meeting with end-to-end encryption” and that “Zoom’s solution and security architecture provides end-to-end encryption and meeting access controls so data in transit cannot be intercepted,” according to the complaint. But Zoom is not entitled to its own definition of end-to-end encryption, the class-action lawsuit said. “The definition of end-to-end encryption is not up for interpretation in the industry,” the complaint said. “Zoom’s misrepresentations are a stark contrast to other videoconferencing services, such as Apple’s FaceTime, which have undertaken the more challenging task of implementing true E2E encryption for a multiple party call.”

Zoom’s failure to provide end-to-end encryption was reported by The Intercept in March 2020. Zoom’s response to that article “made it clear that Zoom both knew that it did not use the industry-accepted definition of E2E encryption and had made a conscious decision to use the term ‘end-to-end’ anyway,” the lawsuit said.

The Zoom application used to include a text box that was revealed by “hovering your cursor over the green lock at the top left corner” and said, “Zoom is using an end to end encrypted connection,” the complaint noted, adding that “Zoom has since changed this text to simply say that the session is encrypted.”

In April 2020, Zoom apologized “for the confusion we have caused by incorrectly suggesting that Zoom meetings were capable of using end-to-end encryption… While we never intended to deceive any of our customers, we recognize that there is a discrepancy between the commonly accepted definition of end-to-end encryption and how we were using it.”

In October 2020, Zoom announced availability of a “technical preview” of its first real end-to-end encryption offering. Zoom’s website says the offering is still in the technical preview stage “and disables several other features,” so Zoom recommends it “only for meetings where additional protection is needed.”

Giving out user data and allowing Zoombombings

Zoom users relied on the company’s promises that “Zoom does not sell users’ data” and that “Zoom takes privacy seriously and adequately protects users’ personal information,” the lawsuit said. Class members did not understand that “Zoom would collect and share [their] personal information with third parties, including Facebook and Google” and “allow third parties, like Facebook and Google, to access [their] personal information and combine it with content and information from other sources to create a unique identifier or profile of [each user] for advertising and behavior influencing purposes,” it continued.

Because Zoom implemented the Facebook SDK, user data was sent by Zoom to Facebook “regardless of whether the user has created a Zoom or Facebook account, and, even worse, before the user would have even encountered Zoom’s terms and conditions or any privacy disclosures,” the lawsuit said. Though Zoom has reportedly since “removed the Facebook SDK, Zoom continues to share similarly valuable user data with Google via Google’s Firebase Analytics SDK, also integrated into the Zoom app. Plaintiffs never granted permission for third parties to extract and use such data—indeed, they were not even aware of the data transmission.” Besides Facebook and Google, Zoom “sends personal data about their users to hotjar, Zendesk, AdRoll, Bing, and others.”

The lawsuit also said that Zoom blamed users for a rash of Zoombombings even though the problem was enabled by Zoom’s security shortcomings. Zoom could have limited meeting disruptions by unauthorized participants with “relatively simple technical solutions… for instance making it easier to allow hosts to cancel a meeting and/or eject a Zoombomber with the push of a single button, screen sharing control defaults, or implementing stronger meeting security (attendee admission) protocols such as identity verification or unique meeting passcodes,” the lawsuit said.

“As early as March 20, 2020, Zoom admitted its product had an issue with Zoombombing. Rather than change security protocols and default features, however, Zoom turned its back on its users, asserting they were to blame through their inability to properly use the program,” the complaint said.

Settlement requirements

The settlement “requires Zoom to not reintegrate the Facebook SDK for iOS into Zoom meetings for a year” and to ask Facebook to “delete any US user data obtained from the SDK.” The security and transparency changes Zoom agreed to also include the following:

• Develop and maintain, for at least three years, documented protocols and procedures for admitting third-party applications for dissemination to users through Zoom’s “Marketplace.”
• Develop and maintain a user-support ticket system for internal tracking of, and communication with users about reports of meeting disruptions.
• Develop and maintain a documented process for communication with law enforcement about meeting disruptions involving illegal content, including dedicated personnel to report serial meeting disrupters to law enforcement.
• Develop and maintain security features such as waiting rooms for attendees, the suspend meeting activities button, and blocking of users from specific countries for a minimum of three years.

Zoom would be required “to better educate users about the security features available to protect meeting security and privacy, through dedicated space on the Zoom website and banner-type notifications.” Zoom’s website will also have to include “centralized information and links for parents whose children are using school-provisioned K-12 accounts.”

After the settlement was announced, Zoom gave media outlets a statement that did not admit any wrongdoing. “The privacy and security of our users are top priorities for Zoom, and we take seriously the trust our users place in us,” Zoom said. “We are proud of the advancements we have made to our platform, and look forward to continuing to innovate with privacy and security at the forefront.”

https://arstechnica.com/?p=1784539

For at least a decade, privacy advocates dreamed of a universal, legally enforceable “do not track” setting. Now, at least in the most populous state in the US, that dream has become a reality. So why isn’t Apple—a company that increasingly uses privacy as a selling point—helping its customers take advantage of it?

When California passed the California Consumer Privacy Act (CCPA) in 2018, the law came with a large asterisk. In theory, the CCPA gives California residents the right to tell websites not to sell their personal data. In practice, exercising that right means clicking through an interminable number of privacy policies and cookie notices, one by one, on every site you visit. Only a masochist or a die-hard privacy enthusiast would go to the trouble of clicking through to the cookie settings every time they’re looking up a menu or buying a vacuum. Privacy will remain, for most people, a right that exists only on paper until there’s a simple one-click way to opt out of tracking across the whole Internet.

The good news is that this ideal is inching closer and closer to reality. While the CCPA doesn’t explicitly mention a global opt-out, the regulations interpreting the law issued by the California attorney general in 2020 specified that businesses would have to honor one, just as they do individual requests. The technology for a universal opt-out didn’t actually exist yet, but last fall, a coalition of companies, nonprofits, and publishers unveiled a technical specification for a global privacy control that can send a CCPA-enforceable “do not track” signal at the browser or device level.

Today, if you live in California, you can enable the global privacy control by using a privacy browser like Brave or downloading a privacy extension, like DuckDuckGo or Privacy Badger, in whatever browser you already use. (Seriously, go do it. The full list of options is here.) Once you do, you’ll automatically tell sites you visit, “Do not sell my personal information” without having to click anything—and, unlike with previous efforts to create a universal opt-out, any decent-size company that does business in California will be legally obligated to comply, which requires adding just a few lines of code to their website.

The state of CCPA enforcement remains murky because some businesses object to the attorney general’s broad interpretation of the law. But California’s government has begun making clear that it intends to enforce the global privacy control requirement. (The more recently passed California Privacy Rights Act, which goes into full effect in 2023, makes this requirement more explicit.)

In mid-July, Digiday reported that Attorney General Rob Bonta’s office had “sent at least 10 and possibly more than 20 companies letters that call on them to honor the GPC.” And an item appeared on a recent list of CCPA enforcement actions on the attorney general’s website noting that a company had been forced to start honoring the signal.

Now, the bad news. While it’s a lot easier to install a privacy extension or browser than click through a million privacy pages, the vast majority of people are still unlikely to do so. (It remains to be seen whether DuckDuckGo papering America’s highways and cities with billboards will inspire a new wave of privacy connoisseurs.)

This matters quite a bit because online privacy rights are collective, not individual. The trouble with pervasive tracking is not merely that it can allow someone to access your personal location data and use it to ruin your life, as recently happened to a Catholic priest whose commercially available Grindr data revealed a pattern of frequenting gay bars. Even if you personally opt out of tracking, you’re still living in a world shaped by surveillance. Tracking-based advertising contributes to the decline of quality publications by eating away at the premium that advertisers pay to reach their audiences. Cheaper to find those readers on social media or even on bottom-feeding extremist news sites. It turbocharges the incentive to relentlessly maximize engagement on social media platforms. None of that will go away until a critical mass of people opt out of being tracked across the board.

That’s why one absence from the list of companies supporting the global privacy control is so conspicuous. Apple burnished its already strong reputation on privacy earlier this year by introducing App Tracking Transparency, a setting that flips the privacy default on iOS devices by forcing apps to get a user’s permission before sharing their data. That is a genuinely big step forward for privacy, since the difference between being opted out by default and opted in is enormous—and indeed, early reports suggest that most iPhone users are declining to give apps permission to track them.

But Apple, despite its stated (and heavily advertised) commitment to privacy, has not incorporated the global privacy control into Safari, the most popular mobile browser in the US and the second-most-popular desktop browser. Nor has it built it into iOS, which accounts for more than half of the US mobile operating system market. That means it’s not doing as much as it could to protect tens of millions of users from having their data sold and shared. The App Tracking Transparency framework is important, but it relies on Apple catching app developers who violate the policy. Safari’s tracking-prevention feature, meanwhile, relies on a technical approach to blocking cookies and other trackers that can often be circumvented.

“For years, companies have found ways to circumvent technical privacy protections. It’s basically an arms race,” says Ashkan Soltani, a privacy researcher who helped develop the global privacy control. “Technical tools are not enough. You need to have the force of law behind it.” That’s where the global privacy control is crucially different from existing tracking prevention. If a business disregards it, it isn’t just violating terms of service or evading some code—it’s breaking the law and risks being slapped with major fines or penalties.

So far, however, none of the biggest browsers have incorporated the feature, keeping it from widespread adoption. This is not shocking in the case of Google, which hasn’t added it to Chrome or Android: The world’s biggest surveillance advertising company is not exactly known for caring much about user privacy. (Google declined to comment for this story.) A Mozilla spokesperson said the company is “looking into the global privacy control and actively considering next steps in Firefox.” It isn’t clear why Apple hasn’t yet joined the party or whether it plans to in the future. The company didn’t respond to multiple requests for comment over the past week.

In the past, Apple has used software design and App Store policies to protect users, stepping into the vacuum created by the lack of comprehensive privacy legislation. Now, in California and any other states that follow its lead—Colorado, for example, will require businesses to honor the global privacy control starting in 2024—the law has finally gotten ahead of the technology. The public won’t start seeing the full benefits until the private sector catches up. If even a privacy-centric company like Apple isn’t interested, though, the wait might be longer than you’d think.

This story originally appeared on wired.com.

https://arstechnica.com/?p=1784258

The US Government Accountability Office (GAO) today rejected Blue Origin’s attempt to block the lunar-landing contract that NASA awarded to SpaceX. The GAO also rejected a similar protest filed by Dynetics.

NASA in April 2020 selected SpaceX, Blue Origin, and Dynetics to design and build human landing systems. But in April 2021, NASA decided to go only with SpaceX and its Starship vehicle for the Artemis program, which is NASA’s plan to return humans to the Moon by 2024.

“The cost of SpaceX’s bid was about half that of Dynetics, and one-fourth the amount received by Blue Origin,” as our coverage at the time said. While budget was apparently the biggest factor, NASA also “praised the [SpaceX] vehicle’s innovative design and future-looking technology that might also one day be used on Mars” and cited Starship advantages including “a spacious cabin for astronauts, two airlocks, and ample payload capability to bring large numbers of experiments to the Moon and return samples to Earth.”

“NASA did not violate procurement law”

NASA’s choice didn’t sit well with Blue Origin, which is owned by Amazon founder Jeff Bezos. Blue Origin filed a protest to the GAO shortly after, claiming that NASA’s process and reasoning for selecting SpaceX were flawed. The GAO announced its decision today, finding that NASA didn’t violate any laws or regulations.

“NASA made award to SpaceX for a total evaluated price of $2,941,394,557,” the GAO said. “After noting that SpaceX submitted the lowest-priced proposal with the highest rating, and that the offers submitted by Blue Origin and Dynetics were significantly higher in price, NASA also concluded that the agency lacked the necessary funding to make more than one award.”

Blue Origin and Dynetics “argued that the agency was required to make multiple awards” because it had previously stated a preference for multiple awards, the GAO said in summarizing the companies’ complaints. The protesting companies also “alleged that the agency was required to open discussions, amend, or cancel the announcement when NASA, after the receipt of proposals, determined that it had less funding than it needed to support multiple HLS [Human Landing System] awards,” the GAO said. The protesters further claimed that “NASA unreasonably evaluated all three of the proposals” and “improperly waived a mandatory solicitation requirement for SpaceX.”

The GAO was not convinced by any of the primary arguments, the agency’s announcement said:

In denying the protests, GAO first concluded that NASA did not violate procurement law or regulation when it decided to make only one award. NASA’s announcement provided that the number of awards the agency would make was subject to the amount of funding available for the program. In addition, the announcement reserved the right to make multiple awards, a single award, or no award at all. In reaching its award decision, NASA concluded that it only had sufficient funding for one contract award. GAO further concluded there was no requirement for NASA to engage in discussions, amend, or cancel the announcement as a result of the amount of funding available for the program. As a result, GAO denied the protest arguments that NASA acted improperly in making a single award to SpaceX.

GAO next concluded that the evaluation of all three proposals was reasonable, and consistent with applicable procurement law, regulation, and the announcement’s terms.

The GAO said it agreed with Blue Origin and Dynetics about one “limited discrepancy in the evaluation” in which “NASA waived a requirement of the announcement for SpaceX” but said that the “protesters could not establish any reasonable possibility” that this created a competitive prejudice.

The GAO announcement was a bit vague, and the agency did not release the full decision because it “may contain proprietary” information. A public version will be issued after the companies are given a chance “to promptly identify information that cannot be publicly released.”

Blue Origin still mad, but it’s NASA’s decision

The GAO also said that it “expresses no view as to the merits” of each company’s proposal, adding that “judgments about which offeror will most successfully meet the government’s needs are reserved for the procuring agencies, subject only to statutory and regulatory requirements.”

Blue Origin told CNBC that “there were fundamental issues with NASA’s decision, but the GAO wasn’t able to address them due to their limited jurisdiction.” The company also said it will “continue to advocate for two immediate providers” because NASA’s “Human Landing System program needs to have competition now instead of later.”

SpaceX CEO Elon Musk responded to the GAO decision on Twitter with a flexed-biceps emoji.

NASA issued a statement saying the GAO “decision enables NASA to award the contract that will ultimately result in the first crewed demonstration landing on the surface of the Moon under NASA’s Artemis plan… An uncrewed flight of Artemis I is on track for this year and a crewed Artemis II mission is planned for 2023.”

https://arstechnica.com/?p=1784297

Scarlett Johansson sued the Walt Disney Company yesterday, alleging that it breached her contract by releasing Black Widow on Disney+ the same day it was released in theaters.

The simultaneous release allowed Disney to pay Johansson less money because she and the Disney-owned Marvel agreed that her compensation for Black Widow “would be based largely on ‘box office’ receipts generated by the picture,” according to Johansson’s complaint filed in Los Angeles County’s Superior Court for the State of California. This was a contract violation because Johansson secured a promise from Marvel that the movie would initially be released in theaters only, the lawsuit said:

To maximize these receipts, and thereby protect her financial interests, Ms. Johansson extracted a promise from Marvel that the release of the picture would be a “theatrical release.” As Ms. Johansson, Disney, Marvel, and most everyone else in Hollywood knows, a “theatrical release” is a release that is exclusive to movie theaters. Disney was well aware of this promise, but nonetheless directed Marvel to violate its pledge and instead release the picture on the Disney+ streaming service the very same day it was released in movie theaters.

The reasons for this were twofold. First, Disney wanted to lure the picture’s audience away from movie theaters and towards its owned streaming service, where it could keep the revenues for itself while simultaneously growing the Disney+ subscriber base, a proven way to boost Disney’s stock price. Second, Disney wanted to substantially devalue Ms. Johansson’s agreement and thereby enrich itself. In the months leading up to this lawsuit, Ms. Johansson gave Disney and Marvel every opportunity to right their wrong and make good on Marvel’s promise. Unlike numerous other movie studios, however—including Warner Brothers who, on information and belief, settled with its talent on films such as Wonder Woman after it released those films “day-and-date” to its streaming service HBO Max last year—Disney and Marvel largely ignored Ms. Johansson, essentially forcing her to file this action.

The lawsuit accuses Disney of intentional interference with contractual relations and inducing breach of contract, alleging that the contract breach “was the direct result of Disney directing Marvel to ignore Ms. Johansson’s agreement and/or overruling Marvel’s wishes to comply with it.” Johansson demanded a jury trial and asked the court for monetary and punitive damages in amounts to be proven at trial.

Johansson’s lawsuit could be just the first of its type against Disney, as actress “Emma Stone is reportedly considering suing Disney over the release of Cruella on Disney+,” according to Screen Rant.

Disney accuses Johansson of “callous disregard” for pandemic

Disney responded to the lawsuit with a statement to Deadline and other media outlets, saying, “There is no merit whatsoever to this filing. The lawsuit is especially sad and distressing in its callous disregard for the horrific and prolonged global effects of the COVID-19 pandemic. Disney has fully complied with Ms. Johansson’s contract and furthermore, the release of Black Widow on Disney+ with Premier Access has significantly enhanced her ability to earn additional compensation on top of the $20 million she has received to date.”

Despite Disney’s claim that the online release gave Johansson “additional compensation,” one “person familiar with details of her contract” told The Wall Street Journal that Disney’s “decision to put the movie on Disney+ is projected to cost Ms. Johansson more than $50 million.”

In response to Disney’s statement, Johansson’s agent, Bryan Lourd, said the company “shamelessly and falsely accused Ms. Johansson of being insensitive to the global COVID pandemic, in an attempt to make her appear to be someone they and I know she isn’t.”

Defining “wide theatrical release”

The case may come down to how the phrase “wide theatrical release” is defined. The contract clause cited by Johansson doesn’t explicitly state that the film could not be released online and in theaters—it says, “if Producer in its sole discretion determines to release the Picture, then such release shall be a wide theatrical release of the Picture (i.e., no less than 1,500 screens).”

Johansson’s lawsuit said that the commonly accepted definition of “wide theatrical release” means that the film was required to run exclusively in theaters for three to four months.

“Ms. Johansson obtained from Marvel a valuable contractual promise that the release of the picture would be a ‘wide theatrical release,'” Johansson’s lawsuit said. “Both parties, as well as Disney, understood this meant that the picture would initially be released exclusively in movie theaters, and that it would remain exclusively in movie theaters for a period of between approximately 90 and 120 days. This roughly 90-120 day theatrical ‘window’ was not only industry-standard at the time the agreement was finalized but also standard practice for prior Marvel movies distributed by Disney, including those starring Ms. Johansson.”

Johansson’s contract gave her “certain fixed compensation” plus “deferred compensation and bonuses directly tied to the amount of worldwide box office receipts,” the lawsuit said.

Previous films were theater-only for months

In the months leading up to the November 2019 launch of Disney+, “Johansson’s representatives sought assurances that Marvel would hold up its end of the bargain with respect to the theatrical release” of Black Widow, the lawsuit said. Marvel’s chief counsel replied in May 2019, “We totally understand that Scarlett’s willingness to do the film and her whole deal is based on the premise that the film would be widely theatrically released like our other pictures. We understand that should the plan change, we would need to discuss this with you and come to an understanding as the deal is based on a series of (very large) box office bonuses.”

Marvel’s statement that the Black Widow theatrical release would be “like our other pictures” is a reference to the “standard Marvel/MCU 90-120 days of theatrical exclusivity,” the lawsuit said.

“At the time the agreement was entered, it was well understood by the parties and Disney that a ‘theatrical release’ referred to an exclusive release in theaters for an extended period of time that was roughly 90-120 days,” the complaint said. Marvel Studios’ previous films “had uninterrupted theatrical windows between 82 and 159 days,” and all seven of Johansson’s previous Marvel movies had theatrical windows of at least 96 days, the lawsuit said.

None of the previous Marvel movies with Johansson “included ‘day-and-date’ releases on streaming platforms as would come to pass with Black Widow; rather, in connection with those films, it took six to eight months before Marvel Studios’ films would be available for streaming on an SVOD [subscription video-on-demand] service like Disney+,” the lawsuit said.

Disney+ charged users $30 for Black Widow

Disney announced it would release Black Widow online and in theaters simultaneously in March 2021, with Disney+ users being charged a one-time fee of $30 for access to the film. It was released on July 9.

In the intervening months, “Johansson, through her representatives, attempted to negotiate with Marvel to reach the aforementioned alternative ‘understanding’ that Marvel’s chief counsel had promised under these circumstances,” the lawsuit said. “Ultimately, however, Marvel ignored this outreach, no resolution was reached, and the picture was simultaneously released in theaters and on Disney+ Premier Access on July 9, 2021.”

“To no one’s surprise, Disney’s breach of the agreement successfully pulled millions of fans away from the theaters and toward its Disney+ streaming service,” the lawsuit continued. “According to Disney’s own self-congratulatory press releases, the picture grossed more than $60 million on Disney+ Premier Access in its first weekend alone.”

Disney executives benefit

The Disney+ release thus “save[d] Marvel (and by extension, Disney) ‘very large’ amounts of money that it would otherwise owe Ms. Johansson,” the lawsuit said. Disney’s stock price jumped 4 percent in the days after the release, and company executives are likely to benefit directly from the streaming service’s success, the lawsuit said:

Disney’s financial disclosures make clear that the very Disney executives who orchestrated this strategy will personally benefit from their and Disney’s misconduct. In fiscal year 2021, Disney’s Chief Executive Officer, Robert Chapek, was awarded equity grants totaling 3.8 times his $2.5 million base salary. The primary justification for that award, according to Disney’s compensation committee (as detailed in the company’s 2021 annual report), was that Mr. Chapek “worked to quickly program new offerings on our DTC [direct-to-consumer] and linear channels” and “launched our direct-to-consumer services in several key markets.” Robert Iger, Mr. Chapek’s predecessor, also received the overwhelming majority of his compensation—just over $16.5 million—in the form of stock grants. The reason for his mammoth award (according to the same annual report) was that he “[s]uccessfully launched Disney+ and drove unprecedented subscriber growth in the first year.” In short, the message to—and from—Disney’s top management was clear: increase Disney+ subscribers, never mind your contractual promises, and you will be rewarded.

To support Johansson’s contention that Disney forced Marvel to violate her contract, the lawsuit cited a February 2021 article in which ‘Variety reported that [Marvel Studios’ President Kevin] Feige ‘was opposed to a hybrid rollout,’ but that ‘the powers that be’ from Disney could still ‘convince Feige to change his mind—or overrule him completely.'” The next month, less than a week before announcing the Disney+ release, “Disney’s Mr. Chapek cleared up any remaining doubt that it was Disney, not Marvel, calling the shots, telling Bloomberg Television that ‘We’ll make the call probably at the last minute in terms of how these films come to market, whether it’s Black Widow or any other title… We’ll be watching the call carefully and make the call when we have to,'” the lawsuit said.

Feige is reportedly “angry and embarrassed” about Disney’s decision, as he tried to convince Disney not to release Black Widow on Disney+ until after a standard theatrical window.

https://arstechnica.com/?p=1784224

A bipartisan infrastructure deal will provide $65 billion for broadband deployment and require ISPs that receive funding “to offer a low-cost affordable plan,” the White House said today.

President Joe Biden pledged early in his term to lower Internet prices, and this appears to be the first tangible result—although it will only affect ISPs that take the new funding, and the White House didn’t release key details about the affordable Internet plans. A White House fact sheet on the $550 billion infrastructure deal with senators included two paragraphs summarizing the broadband portions:

[M]ore than 30 million Americans live in areas where there is no broadband infrastructure that provides minimally acceptable speeds—a particular problem in rural communities throughout the country. The deal’s $65 billion investment ensures every American has access to reliable high-speed Internet with a historic investment in broadband infrastructure deployment, just as the federal government made a historic effort to provide electricity to every American nearly one hundred years ago.

The bill will also help lower prices for Internet service by requiring funding recipients to offer a low-cost affordable plan, by creating price transparency and helping families comparison shop, and by boosting competition in areas where existing providers aren’t providing adequate service. It will also help close the digital divide by passing the Digital Equity Act, ending digital redlining, and creating a permanent program to help more low-income households access the Internet.

“Low-cost” definition not released yet

The announcement didn’t say what speeds or prices will have to be offered by government-funded ISPs in the required low-cost plans. It also didn’t say whether those low-cost plans would be available to all customers or only those who meet certain income requirements.

The promise of “a permanent program to help more low-income households access the Internet” may mean the $50-per-month subsidies that Congress created for the pandemic will continue in some form. Currently, the subsidies are slated to end when the $3.2 billion fund runs out of money or six months after the Department of Health and Human Services declares an end to the COVID-19 health emergency, whichever is sooner. Four million households have enrolled in the subsidy program so far.

The $65 billion is down from Biden’s original proposal of $100 billion over eight years.

Low upload standard would help wireless and cable ISPs

Biden’s announcement didn’t specify the minimum upload and download speeds ISPs will have to offer to qualify for government funding. As Light Reading notes, fixed-wireless home-Internet providers have been “desperate to convince policymakers to settle on a definition of broadband that wireless technologies would be able to meet.” Cable companies have similarly been pushing for a standard with low upload speeds because cable technology is restricted on the upstream side.

Light Reading wrote that a “draft of the bipartisan broadband bill that’s currently wending through Congress” would allow funding for ISPs that offer 100Mbps downloads and 20Mbps uploads, which would make it easier for fixed-wireless and cable providers to win government funding. A 100Mbps standard for both downloads and uploads would guarantee more money for fiber, which provides the fastest upload speeds and is the most future-proof broadband technology.

Ending redlining and hidden fees

The Digital Equity Act that Biden said is included in the deal was introduced in March and would establish one grant program “to make distributions to states based on their populations, demographics, and availability and adoption of broadband.” Meanwhile, another grant program would be “for supporting efforts to achieve digital equity, promote digital inclusion, and stimulate adoption of broadband,” according to the official bill summary.

It’s not clear whether Biden’s deal with Congress does anything else to end digital redlining, which refers to ISPs building networks in wealthy areas while ignoring poor ones.

The White House promise of “creating price transparency and helping families comparison shop” seems to refer to Biden’s previously stated goals of ending hidden fees by requiring ISPs to clearly disclose the full cost of service and limiting early termination fees that make it expensive to switch ISPs in areas where customers actually have choices. Biden recently urged the FCC to handle that, but it could also be mandated by Congress.

As always, the details will have a big impact on whether the legislation helps people get fast, affordable Internet service. For example, many ISPs are only letting customers get the $50-per-month pandemic subsidies on certain plans, in some cases forcing users onto more expensive plans to get the temporary discount. Sending money to ISPs for broadband deployment also requires careful management to ensure that money is sent to the right places and to ISPs that aren’t likely to miss build-out deadlines.

Biden originally pledged to give priority access to funding to municipal broadband networks and other publicly owned providers, but he apparently dropped that goal in negotiations. Republicans have tried to ban municipal broadband networks entirely and consistently seek to send government funding to private ISPs instead.

“Slim number of Republicans” support deal

There are apparently just enough Republicans willing to vote for the infrastructure deal to give it the 60 votes needed to cut off debate in the the Senate. “A slim number of Republicans are expected to vote to advance” the bill in a vote expected to happen Wednesday night, Politico reported.

The lead-up to the vote may be contentious. “This idea of getting on a bill that’s still being written is still a bad idea,” Sen. John Cornyn (R-Texas) said, according to Politico. “We’re going to insist upon amendments because this bill’s been negotiated by 20 people but there are 80 other senators.”

A vote tonight apparently wouldn’t be the end of the Senate process, NPR wrote:

Sen. Joe Manchin, (D-W.Va.) said he expects the first vote will be on placeholder legislation that will later be amended to include the full text of the agreement. That process is not uncommon; it allows the Senate to move ahead while staff drafts the legal legislative language necessary for a bill to come up for a vote.

It’s not clear exactly when the full text will be available publicly. “Sen. Kyrsten Sinema (D-Ariz.), who served as the lead negotiator for the Democrats, said lawmakers are putting the finishing touches on the bill but should allow the rest of the Senate to begin reading it soon,” according to NBC News. Sinema also said that lawmakers have “most of the text done, so we’ll be releasing it today, and then we’ll update it as we get those last pieces finalized.”

https://arstechnica.com/?p=1783771

A former eBay security manager who pleaded guilty for his role in a cyberstalking conspiracy was sentenced to 18 months in prison yesterday.

Philip Cooke, former senior manager of security operations for eBay’s Global Security Team, pleaded guilty in October 2020 to one count of conspiracy to commit cyberstalking and one count of conspiracy to commit witness tampering. He was sentenced to 18 months in federal prison on each charge, with the two sentences to be served concurrently, according to an order issued in US District Court for the District of Massachusetts. He was also fined $15,000 and sentenced to supervised release of three years after he gets out of prison.

The Department of Justice alleged that in 2019, Cooke helped plan and attempt to cover up the stalking of Ina and David Steiner of Natick, Massachusetts, who run the news website EcommerceBytes. Cooke was one of seven eBay employees accused of harassment involving sending threatening messages and deliveries of live cockroaches, a funeral wreath, and a bloody pig mask to the couple’s home. Several conspirators allegedly traveled from California to Massachusetts to conduct surveillance on the couple, but Cooke was not among them. Cooke wasn’t included in the initial charges filed in June 2020 but was charged a few weeks later.

eBay executives were angered by EcommerceBytes’ news coverage of eBay. Text messages show that then-Chief Communications Officer Steven Wymer wrote, “We are going to crush this lady,” referring to editor Ina Steiner. In another text, then-CEO Devin Wenig allegedly wrote to Wymer, “Take her down.” Wenig and Wymer were not charged. They were referred to as “Executive 1” and “Executive 2” in court documents but subsequently identified in news reports. Wenig resigned, and Wymer was fired.

Four others pleaded guilty, await sentencing

Four other former eBay security employees are scheduled for sentencing hearings in late September after pleading guilty in October 2020 to the same charges of conspiracy to commit cyberstalking and conspiracy to tamper with witnesses. They are waiting to be sentenced. The employees are Brian Gilbert, former senior manager of special operations for eBay’s Global Security Team; Stephanie Stockwell, former manager of eBay’s Global Intelligence Center; Stephanie Popp, eBay’s former senior manager of Global Intelligence; and Veronica Zea, a former eBay contractor who was an intelligence analyst in eBay Global Intelligence.

eBay’s former Senior Director of Safety & Security James Baugh and former Director of Global Resiliency David Harville pleaded not guilty and are still facing charges. Additionally, the Steiners filed a civil lawsuit against eBay, Wenig, Wymer, Baugh, Harville, and the former eBay employees who pleaded guilty. The Steiners’ lawsuit said they now suffer from “permanent psychological trauma and damage” because of the cyberstalking, hampering their ability to operate their business. The Steiners allege that Wenig and Wymer “provided the other Defendants with carte blanche authority to terminate the reporting of the Steiners by whatever means necessary.”

Cooke had asked for a sentence of home confinement instead of prison time, claiming that he warned fellow employees against the worst parts of the plan such as sending threatening deliveries, publishing their home address, conducting surveillance in person, and installing a GPS tracking device on the Steiners’ vehicle. Cooke’s sentencing memorandum also said he had a drinking problem that was exacerbated by a “drinking culture” at eBay. Cooke worked in eBay’s security division after retiring from the Santa Clara Police Department.

“Good plan and cover”

The DOJ said that Cooke helped plan the harassment and coverup attempts. “Good plan and cover,” Cooke wrote in a WhatsApp message to co-conspirators, according to a charging document. Cooke’s message also advised fellow employees to find “a friendly” contact in the local police department and to “be convincing so [police] don’t start looking to find video of who purchased the gift cards” that eBay employees used to send the pig masks and other harassing deliveries to the Steiners. Cooke responded with two thumbs-up emojis after Gilbert wrote, “We can control the local cop and maybe provide a video from a different Santa Clara Safeway,” the court document said.

More details on the case are available in this article we published last week. eBay fired the employees and cooperated in the investigation.

https://arstechnica.com/?p=1783665

President Joe Biden has warned that cyberattacks could escalate into a full-blown war as tensions with Russia and China mounted over a series of hacking incidents targeting US government agencies, companies, and infrastructure.

Biden said on Tuesday that cyber threats including ransomware attacks “increasingly are able to cause damage and disruption in the real world.”

“If we end up in a war, a real shooting war with a major power, it’s going to be as a consequence of a cyber breach,” the president said in a speech at the Office for the Director of National Intelligence, which oversees 18 US intelligence agencies.

A number of recent hacks revealed the extent of US cyber vulnerability, ranging from extensive espionage breaches that have struck at the heart of government to ransomware attacks that have brought operations at an important oil pipeline and meat packing plants to a halt.

The Biden administration has accused the governments of Russia and China, or hackers based inside the two countries, of some of the attacks. US officials have warned that the administration would respond with a “mix of tools seen and unseen” actions, but cyber breaches have continued.

Although he did not say who such a war might be fought against, Biden immediately name-checked Russia’s president Vladimir Putin, alleging that Russia was spreading misinformation ahead of the 2022 US midterm elections.

“It’s a pure violation of our sovereignty,” he said.

“Mr. Putin… has a real problem. He is sitting on top of an economy that has nuclear weapons and oil wells and nothing else. Nothing else,” Biden said. “He knows he’s in real trouble, which makes him even more dangerous.”

At a June summit in Geneva, Biden personally warned Putin that the US would “respond with cyber” if the Russian state or Russian-based hackers targeted critical US infrastructure.

The prohibited sectors spanned energy, health care, IT, and commercial facilities, all of which have already allegedly been targeted by Russian hackers since the 2020 US elections. Others included transport, financial services, and chemicals.

Biden also said Chinese President Xi Jinping was “deadly earnest” about China becoming the most powerful military force in the world by the 2040s, as well as the largest and most prominent economy.

“It’s real… This boy’s got a plan,” Biden said, adding: “We better figure out how we’re going to keep pace without exacerbating [the situation].”

Biden stressed that cyberattacks were just one aspect of the growing threats facing the US, saying that there would be more developments in the next 10 years than in the past 50, placing a tremendous burden on the intelligence community.

“It’s really going to get tougher,” he said.

© 2021 The Financial Times Ltd. All rights reserved Not to be redistributed, copied, or modified in any way.

https://arstechnica.com/?p=1783691

Facebook mastered social media by giving people an easy way to share their offline lives with friends, family, and complete strangers on the Internet. So why is the company now trying to invent a virtual universe that effectively turns its back on reality?

Over the past week, the social media company has blitzed media outlets with news about its “metaverse” initiative, a plan to create virtual worlds where people can interact to play games, have meetings, and so on. Last week, CEO Mark Zuckerberg shared his metaverse plans with the public in an interview with The Verge. Then, earlier this week, Facebook announced that it would be putting together a metaverse team staffed with a handful of longtime VPs.

It’s clear that Zuckerberg has been thinking about this metaverse idea for a while. But the timing of Facebook’s announcement is interesting, to say the least. Facebook has “a history of doing these kinds of technical projects that look like they might be revolutionary at times when they’re being criticized for their lack of social responsibility,” Jen Goldbeck, a computer scientist and professor at the University of Maryland, told Ars.

Facebook has faced its share of scrutiny in recent months. Lawmakers have been floating antitrust and Section 230 bills that would hit the company hard. It was caught earlier this year autogenerating pages for white supremacist groups. And yesterday, hearings began in the House of Representatives into the insurrection that breached the US Capitol in January, which was partially organized using Facebook apps and sites.

It’s probably an overstatement to say that the metaverse news was released to serve as an intentional distraction from the company’s current problems. But the thought undoubtedly crossed someone’s mind at the company. There’s a “70 percent” chance that Facebook’s metaverse project is a “distraction from all the bad things that are going on,” Goldbeck said. “The last thing they want is more discussion of their algorithms and Q-Anon and extremist groups.”

As a distraction, the metaverse is almost too perfect. It’s a flashy news item that attempts to position Facebook and Zuckerberg as visionaries inventing the future. It’s also literally a way to escape reality. If Zuckerberg ever wanted a metaverse to escape to, where Facebook exerted influence over everything from physics to religion, that time is probably now.

Into the metaverse

The term “metaverse” first appeared in Snow Crash, a 1992 sci-fi novel by Neal Stephenson, where it was a virtual world in which people could interact through their avatars, complete with rules and social norms that differed from the real world. The concept appeared in other forms before Stephenson’s book, and it has been revisited and rehashed numerous times over the years.

Zuckerberg’s vision of the metaverse sounds pretty similar. “You can think about the metaverse as an embodied Internet, where instead of just viewing content, you are in it,” he said in his interview with The Verge.

Virtual reality was a key part of Stephenson’s vision, and it comes up a lot in Zuckerberg’s interview. The executive leading the metaverse team, Andrew Bosworth, heads VR and AR at the company. That Facebook is looking for another solution for VR isn’t surprising—it has experimented with VR to middling success. The company’s Oculus headsets have run the gamut from good to bad, and while Zuckerberg’s VR demo in 2016 was impressive, his virtual trip to hurricane-ravaged Puerto Rico was cringe-worthy. Yet Facebook is sticking with it, no doubt in part because it dropped $2 billion on Oculus.

Still, it’s not clear that the metaverse is the killer app for VR, nor is it an obvious evolution of social media. “There was a very clear path for a while,” Goldbeck said. “We were going to have more interactive social media, we were going to have more mobile stuff, then we were going to have more kinds of media. Now, what is the next thing? This feels exactly like a thing that someone would say, ‘Well, maybe the next big thing is the metaverse.’”

Turning away from the real world

Inside Facebook, developing the metaverse may seem like an obvious next step. The company has a large user base that uses its platforms for a variety of everyday things, from sharing updates to shopping, gaming, and more. Add in a dollop of VR and some other buzzword-laden technologies, and you’ve got a metaverse.

In some use cases, Facebook might be on to something. “There are places where people are happy to stay virtual,” Goldbeck said. “This is the tension we’re starting to see emerge now. There are a lot of people who are like, ‘This remote working is great.’” And Facebook could be the company to make it happen. They have deep pockets and a roster of talented engineers. “There are people inside Facebook whose job it is to figure out what the next big thing is,” Goldbeck said.

But in many ways, the metaverse project is a fundamental shift away from what made Facebook successful. First, Facebook is a company that tends to succeed when it iterates on existing ideas or solves genuine problems. Zuckerberg’s initial version of Facebook, called “Facemash,” was a 2003 Harvard knockoff of another site called “Am I Hot or Not” that launched in 2000. Later Facebook iterations aped features from Friendster, MySpace, and others.

Even the company’s technological crown jewel, the News Feed, wasn’t created due to pie-in-the-sky dreaming about what could take social media to the next level. It was a solution to a real problem—as people added more friends on Facebook, they were getting inundated with updates. News Feed and its algorithms helped cut down on the chaos, prioritizing content that a user was more likely to engage with. Another Facebook hallmark—ads in the News Feed, the company’s current cash cow—was born out of its struggles to monetize users on mobile phones.

The metaverse also cuts against a key part of Facebook’s brand—allowing people to share their lives with friends and family. For many, the platform’s appeal comes from users’ ability to like, comment on, and share content related to their real lives—not their virtual ones.

Zuckerberg may truly believe that the metaverse is the next big thing. But it can also be true that the project serves as a convenient distraction from the problems the company faces. At the same time, it can be a reward for loyal executives who want to dream about the future rather than think about automated content moderation. And it can also be a message to investors that the company is making good on past investments in VR and other technologies that have yet to pay off.

In a way, that’s the beauty of the metaverse. It can be whatever you want it to be.

https://arstechnica.com/?p=1783647

The Federal Communications Commission wants SpaceX to give up a portion of the $885.51 million in broadband funding it was awarded in a reverse auction in December 2020.

SpaceX’s Starlink satellite broadband division was one of the biggest winners in the FCC’s Rural Digital Opportunity Fund (RDOF) grants announced in Ajit Pai’s last full month as FCC chairman. Overall, Pai’s FCC awarded $9.2 billion over 10 years ($920 million per year) to 180 bidders nationwide, with SpaceX slated to get $885.51 million over 10 years to serve homes and businesses in parts of 35 states.

Pai apparently mismanaged the auction, as an announcement yesterday from Acting Chairwoman Jessica Rosenworcel’s office said the FCC has to “clean up issues with the program’s design originating from its adoption in 2020.” The FCC cited “complaints that the program was poised to fund broadband to parking lots and well-served urban areas.” The FCC suggested that SpaceX give up its funding in about 6 percent of the census blocks where it’s slated to get money. Other ISPs are being asked to give up smaller portions of their funding.

Pai sent money to wrong areas

The rules that Pai set for the first RDOF auction required funding to go only to census blocks where no providers offer speeds of 25Mbps down and 3Mbps up. A planned Phase 2 auction would target such areas, but the first auction was meant only for places that are completely unserved.

Rosenworcel’s office sent letters to dozens of winning bidders yesterday, suggesting that they voluntarily give up a portion of their funding. The letter to SpaceX stands out for the sheer number of census blocks—about 6,500 in 34 states—where the FCC is challenging SpaceX’s funding. Those 6,500 are among about 113,900 census blocks where SpaceX tentatively won FCC grants.

The letters to SpaceX and other ISPs pointed to concerns “that certain areas included in the Rural Digital Opportunity Fund auction are already served by one or more service providers that offer 25/3Mbps broadband service or otherwise raise significant concerns about wasteful spending, such as parking lots and international airports.”

The letters continued:

It is your responsibility to conduct due diligence to ensure that you can meet the Rural Digital Opportunity Fund public interest obligations. Attached to this letter is a list of census blocks covered by winning bids associated with your long-form application and where such concerns have been raised. We recommend that you assess whether existing service in these areas will affect your ability to meet all program requirements and deployment milestones.

If you determine that you will no longer pursue support for any of your winning bids, promptly send an email to Auction904@fcc.gov identifying the specific census block groups with a brief explanation of your decision to default on your bid. Defaults will be announced by public notice.

We contacted SpaceX about the FCC letter yesterday and will update this article if we get a response.

The letters say the FCC will consider waiving “penalties normally associated with defaults” in cases where “defaulting on these bids will serve the public interest by… targeting scarce Universal Service funds to where they are needed most.” The FCC could take action to block funding and penalize ISPs that don’t voluntarily withdraw their bids.

Census-block screwups

Even before Pai conducted the auction, Rosenworcel urged him to delay awarding grants to ISPs until the commission completes a plan to create a more accurate map showing exactly where broadband has and hasn’t been deployed. The FCC’s current data simply measures how many ISPs are in each census block without showing whether any specific address has service. The Pai-led FCC auction apparently didn’t even get things right at the census-block level, as the FCC now says that a significant amount of the funding was awarded to the wrong areas.

Overall, the FCC sent 197 letters to ISPs that need to evaluate whether to keep pursuing all of their winning bids. Some ISPs received a bunch of letters for different operating divisions. For example, Charter got letters in nearly 20 states, listing a total of about 300 challenged census blocks. Charter had won even more funding than SpaceX—$1.22 billion to serve 1.06 million homes and businesses in 24 states—so it isn’t being asked to give up a significant percentage. CenturyLink, Frontier, Cox, and Windstream all received letters in several states.

The FCC said it is ready to authorize the release of $311 million of the $9.2 billion in pending funding, saying this will let 48 ISPs “bring 1Gbps broadband speeds to nearly 200,000 homes and businesses over the next 10 years.” Those ISPs are listed here.

The RDOF and other universal service programs run by the FCC are paid for by Americans through fees imposed on phone bills.

Starlink in parking lots

Research by consumer-advocacy group Free Press was one of the catalysts that led to the FCC’s auction cleanup effort. Free Press found that “nearly 13 percent of the money awarded to Starlink—$111 million—is to provide service in urban areas,” as we wrote in December. That included “a large number of very urban areas that the FCC’s broken system deemed eligible for awards,” such as locations at or adjacent to major airports in Atlanta, Chicago, Denver, New York City, Seattle, Las Vegas, Newark, Miami, Boston, Minneapolis-Saint Paul, Fort Lauderdale-Hollywood, Detroit, and Philadelphia.

As Free Press noted, SpaceX also won funding in places such as “the Jersey City Target store”; census blocks “with luxury hotels” in Chicago; “empty parking lots, grassy fields and highway medians” near the District of Columbia; a “parking garage in downtown Miami Beach, two blocks from the beach, surrounded on all sides by multiple companies offering gigabit service”; a street in San Francisco “that borders the southern edge of Golden Gate Park”; and “a parking lot outside the Pentagon.” Free Press wrote a six-part series titled “Fiber to the Clubhouse: Pai Subsidizes Broadband for the Rich.”

Pai was “in a rush to take credit”

Free Press Research Director Derek Turner praised the FCC’s action yesterday. “In a rush to take credit for this program before his departure, Ajit Pai ignored early criticism and rapidly awarded money to the likes of Elon Musk for building broadband bridges to nobody,” Turner said. “Pai wanted to put a pretty bow on a bad process. Under Rosenworcel, the FCC seems determined to do the due diligence that Pai skipped to ensure that federal money actually connects real people—as opposed to traffic medians—to affordable services.”

Rosenworcel has been leading the FCC without a Democratic majority as President Joe Biden still hasn’t nominated another commissioner to break the 2-2 deadlock between Democrats and Republicans.

Yesterday’s FCC announcement pleased a group of rural broadband providers that objected to other ISPs’ funding awards. The group calls itself the Ensuring RDOF Integrity Coalition and had previously criticized many of the RDOF funding awards in an FCC filing. “These remedial actions by the FCC only begin to reveal the underlying problems of several RDOF applications,” the group’s counsel, Bob Silverman, said in a press release yesterday. In its earlier filing, the group urged the FCC to “ensure that funding does not go to unserviceable locations such as parking lots, playgrounds, shrubbery, rusted-out propane tanks, and the like.”

Republican and Democratic members of Congress also raised concerns about funding potentially going to ISPs that can’t deliver on their promises.

Starlink deployment shouldn’t suffer

Losing a portion of the FCC funding shouldn’t have much effect on the Starlink network buildout. Unlike wired ISPs, Starlink will be able to offer service just about anywhere from the thousands of low-Earth-orbit satellites the company is launching. The primary limit for Starlink is the number of customers it can serve in each geographic region, but that’s due to network-capacity constraints rather than funding problems. Starlink’s technology is best-suited for sparsely populated areas.

There probably won’t be any significant impact on future Starlink customers, either. SpaceX didn’t promise to charge lower prices in FCC-funded areas. All it has to do to meet the requirement is offer service at specified speeds in the funded census blocks, which it would likely do with or without FCC funding. SpaceX CEO Elon Musk has promised global Starlink coverage and said the company is on track to invest $5 billion to $10 billion in Starlink before it reaches a “fully positive cash flow.”

Fixed-wireless ISP in trouble at FCC

The FCC issued an order blocking the funding that fixed-wireless provider LTD Broadband won in three states. The FCC is also blocking funding for a company in Florida.

The FCC said it “will not tolerate any provider participating in the program that is not serious about providing broadband service or has not made appropriate efforts to secure state approvals” and thus “rejected requests from AB Indiana in Florida and LTD Broadband in California, Oklahoma, and Kansas to waive program deadlines, in light of their failure to act in a timely way to seek state certification.” The FCC said it will soon issue a public notice “finding AB Indiana in default on its bids in Florida and LTD in default on its bids in California, Kansas, and Oklahoma.”

LTD had been awarded $1.32 billion to serve 528,088 locations in 15 states. The company also received a letter challenging its funding in over 3,100 census blocks. LTD CEO Corey Hauer declined to comment when contacted by Ars.

Disclosure: The Advance/Newhouse Partnership, which owns 13 percent of Charter, is part of Advance Publications. Advance Publications owns Condé Nast, which owns Ars Technica.

https://arstechnica.com/?p=1783431

A UK government agency is worried that OneWeb, SpaceX’s Starlink, and similar low Earth orbit (LEO) satellite-broadband systems could block each others’ signals.

Ofcom, the UK’s communications regulator, proposed new rules today in a report that details its interference concerns. Ofcom also said it intends to amend satellite licenses already issued to SpaceX and OneWeb to require coordination of frequency use. Without new requirements, the risk of interference could prevent competition by shutting new players out of the market, Ofcom said.

Non-geostationary satellite orbit (NGSO) systems are more complex than the traditional geostationary type because they use hundreds or thousands of satellites, Ofcom noted. “Satellite dishes need to track these satellites as they move across the sky, unlike existing satellite networks, where the dishes are fixed pointing at a single satellite which is stationary in the sky,” the Ofcom report said. Because so many low-Earth-orbit satellites are being launched, “there is a risk of satellites from two different operators appearing to be in the same part of the sky,” causing interference known as “in-line events” in which multiple operators’ satellites are lined up in the sky, Ofcom wrote.

This interference can affect uplink and downlink transmissions between satellites and user terminals that serve individual homes, the report said. The interference can also affect links between satellites and the Gateway Earth stations that connect to the Internet backbone.

“Since NGSO satellites are moving relative to each other and relative to the ground, in-line events may individually only be brief, maybe a few seconds,” Ofcom wrote. “However, if an in-line event occurs and causes interference, it may take longer for the terminal to reconnect to the network. The interference could continue to repeat over time, reoccurring in a regular pattern which will depend on the orbits of the respective systems.”

Outages from interference

Users could lose service when there’s interference to either the user terminal or gateway earth stations, but interference to a gateway station would affect many more users. “[T]he impact of interference on gateway links would be much greater than on individual user links as each gateway provides connectivity for many users (perhaps hundreds or thousands of users depending on the design of the system), so a loss of connection due to interference at the gateway will be experienced more widely across the network,” Ofcom wrote.

Gateway Earth stations operated by different companies “are likely to require large minimum separation distances” of tens of kilometers to avoid interference, Ofcom wrote. In contrast, “multiple GSO [geostationary satellite orbit] gateways can be located on a single site” without causing harmful interference to each other.

The Ofcom report listed five NGSO constellations that are planned or already semi-operational. The biggest example is SpaceX, which is offering beta service from 1,500 already-launched satellites and has over 4,400 satellites planned for its initial phase. Amazon’s Kuiper division hasn’t launched a satellite yet, but it has 3,236 satellites planned in its initial phase, the report noted.

OneWeb—which is co-owned by the UK government and Bharti Global—has launched over 200 satellites and has plans for 648 satellites in its initial phase. Telesat and Kepler round out the list, with plans for 298 and 140 satellites, respectively.

Here’s the Ofcom chart listing low-Earth-orbit satellite networks:

Coordination difficult

The US Federal Communications Commission in 2017 adopted rules, including power limits, to minimize the danger of interference in NGSO systems. The FCC adopted different rules for different slices of spectrum. In the 17.8 to 18.3 GHz band, for example, the FCC said, “while terrestrial use of this band is significant, there are areas, particularly rural areas, where terrestrial deployment is less dense and by using mitigating techniques like siting considerations, off-axis rejection, and shielding, we expect FSS [fixed-satellite service] earth stations will be able to operate successfully without receiving harmful interference… If interference does occur, earth stations can switch to other bands not shared with terrestrial users or use alternative mitigation techniques.”

The FCC also imposed specific conditions to prevent interference and space debris on licenses awarded to SpaceX, OneWeb, Amazon, and others.

Ofcom is worried that the global system for coordinating satellites, overseen by the International Telecommunication Union [ITU], isn’t good enough to prevent NGSO problems. “The potential for harmful interference between different satellite systems is usually managed by operators cooperating with each other under the ITU satellite coordination procedures,” Ofcom wrote.

The agency added:

However, coordination between NGSO systems is proving to be more challenging due to the dynamic nature of these systems, combined with operators having differing rates of deployment (some operators holding older filings will not deploy their systems for a few years) and changing their architecture over time. We are therefore concerned that NGSO satellite services could be deployed before an appropriate level of coordination has been possible with other operators.

Ofcom is also worried about the coexistence of user terminals when two or more companies provide LEO satellite service in the same area:

A lack of agreement over how user terminals of different systems can coexist in the same area and band could restrict competition as a result of earlier deployed systems hindering later ones. Once one operator starts deploying user terminals, other operators wishing to launch services using the same band may expect to experience harmful interference from the existing user terminals. In the worst case, this could mean that the quality of their broadband services would not be sufficiently reliable in order to enter the market. Nonetheless, the established player could have an incentive to cooperate given that the interference is likely to be mutual, i.e. their services could be degraded as well.

New rules, license changes

Ofcom said its goal in issuing new rules is to minimize interference while encouraging competition. The agency proposed, among other things, “an additional explicit license condition requiring NGSO licensees to cooperate so they can co-exist and operate within the UK without causing harmful radio interference to each other.” Ofcom said it also intends to “[i]ntroduce checks when we issue new NGSO licenses so that these are only granted if all systems (existing and new) are able to coexist and provide services to end users” and implement new conditions letting Ofcom “take action to resolve degradation to services if this were to occur at a particular location or location(s) in the UK.”

To preserve competition, Ofcom said it will “introduce a competition check” into its licensing process to account for the “technical constraints that the gateway or user terminals could create on future licensees.” Ofcom said:

In particular, in a market that was concentrated, if there was limited prospect of the licensee system and future systems (applicants) being able to technically coexist, then this could form a barrier to future entry to the market. As a result, we are proposing that a key piece of information that applicants should provide when applying for a network license is credible evidence about the technical ability for their system and future systems to coexist. This would include evidence about the flexibility of their system and/or what reasonable steps new licensees could easily undertake to protect them. This information would also be used when assessing whether it is reasonable for new applications and existing services to coexist, to understand the reasonableness of mitigations being undertaken by existing licensees.

Ofcom said it plans to review all NGSO licenses to determine which companies are using the same frequencies. The agency said it will also amend the existing licenses held by SpaceX Starlink, OneWeb, and Kepler. The changes would require “NGSO licensees to cooperate with the other NGSO licensees operating in the same frequencies so they can coexist,” and allow Ofcom “to require operators to take action in cases of interference between NGSO systems which impacts the provision of services to users in particular location(s) in the UK.”

Ofcom said it will take comments on its proposals until September 20, 2021.

We contacted SpaceX about Ofcom’s report and will update this article if the company provides a response.

https://arstechnica.com/?p=1783121