The loss triggers remedies, including an injunction preventing additional sales of stolen goods and refunding every customer who bought them. Feldman’s client must also turn over any stolen goods in their remaining inventory and disgorge profits. Other damages may be owed, along with interest. Ars could not immediately reach an attorney for the plaintiffs to discuss the sanctions order or resulting remedies.

Failla emphasized in her order that Feldman appeared to not appreciate “the gravity of the situation,” repeatedly submitting filings with fake citations even after he had been warned that sanctions could be ordered.

That was a choice, Failla said, noting that Feldman’s mistakes were caught early by a lawyer working for another defendant in the case, Joel MacMull, who urged Feldman to promptly notify the court. The whole debacle would have ended in June 2025, MacMull suggested at the hearing.

Rather than take MacMull’s advice, however, Feldman delayed notifying the court, irking the judge. He testified during the heated sanctions hearing that the delay was due to an effort he quietly undertook, working to correct the filing. He supposedly planned to submit those corrections when he alerted the court to the errors.

But Failla noted that he never submitted corrections, insisting instead that Feldman kept her “in the dark.”

“There’s no real reason why you should have kept this from me,” the judge said.

The court learned of the fake citations only after MacMull notified the judge by sharing emails of his attempts to get Feldman to act urgently. Those emails showed Feldman scolding MacMull for unprofessional conduct after MacMull refused to check Feldman’s citations for him, which Failla noted at the hearing was absolutely not MacMull’s responsibility.

Feldman told Failla that he also thought it was unprofessional for MacMull to share their correspondence, but Failla said the emails were “illuminative.”

At the hearing, MacMull asked if the court would allow him to seek payment of his fees, since he believes “there has been a multiplication of proceedings here that would have been entirely unnecessary if Mr. Feldman had done what I asked him to do that Sunday night in June.”

https://arstechnica.com/tech-policy/2026/02/randomly-quoting-ray-bradbury-did-not-save-lawyer-from-losing-case-over-ai-errors/

A few Senate Democrats introduced a bill called the ‘‘ICE Out of Our Faces Act,” which would ban Immigration and Customs Enforcement (ICE) and Customs and Border Protection (CBP) from using facial recognition technology.

The bill would make it “unlawful for any covered immigration officer to acquire, possess, access, or use in the United States—(1) any biometric surveillance system; or (2) information derived from a biometric surveillance system operated by another entity.” All data collected from such systems in the past would have to be deleted. The proposed ban extends beyond facial recognition to cover other biometric surveillance technologies, such as voice recognition.

The proposed ban would prohibit the federal government from using data from biometric surveillance systems in court cases or investigations. Individuals would have a right to sue the federal government for financial damages after violations, and state attorneys general would be able to bring suits on behalf of residents.

The bill was submitted yesterday by Sen. Edward J. Markey (D-Mass.), who held a press conference about the proposal with Sen. Jeff Merkley (D-Ore.), and US Rep. Pramila Jayapal (D-Wash.). The Senate bill is also cosponsored by Sens. Ron Wyden (D-Ore.), Angela Alsobrooks (D-Md.), and Bernie Sanders (I-Vt.).

“This is a dangerous moment for America,” Markey said at the press conference, saying that ICE and CBP “have built an arsenal of surveillance technologies that are designed to track and to monitor and to target individual people, both citizens and non-citizens alike. Facial recognition technology sits at the center of a digital dragnet that has been created in our nation.”

https://arstechnica.com/tech-policy/2026/02/ice-out-of-our-faces-act-would-ban-ice-and-cbp-use-of-facial-recognition/

As Neocities grew, Drake told Ars that much of his focus has been on improving content moderation. He works closely with a full-time dedicated content moderation staffer to quickly take down any problematic sites within 24 hours, he said. That effort includes reviewing reports and proactively screening new sites, with Drake noting that “our name domain provider requires us to take them down within 48 hours.”

Microsoft prohibits things like scraping content that could be considered copyright infringement or automatically generating content using “garbage text” to game the rankings. It also monitors for malicious behavior like phishing, as well as for prompt injection attacks on Bing’s large language model.

It’s unclear what kind of violations Microsoft found ahead of instituting the complete block; however, Drake told Ars that he has yet to identify any content that may have triggered it. He said he would promptly remove any websites flagged by Microsoft, if he could only talk to someone who could share that information.

“Naturally, we still don’t catch 100 percent of the sites with proactive moderation, and occasionally some problematic sites do get missed,” Drake said.

Although Drake is curious to learn more about what triggered the blocks, he told Ars that it’s clear that non-violative sites are still invisible on Bing.

One of the longest-running and most popular Neocities sites, Wired Sound for Wired People, is a perfect example. The bizarre, somewhat creepy anime fanpage is “very popular” and “has a lot of links to it all over the web,” Drake said. Yet if you search for its subdomain, “fauux,” the site no longer appears in Bing search results, as of this writing, while Google reliably spits it out as the top result.

Drake said that he still believes that Bing is blocking content by mistake, but Bing’s automated support tools aren’t making it easy to defend creators who are randomly blocked by one of the world’s biggest search engines.

“We have one of the lowest ratios of crap to legitimate content, human-made content, on the Internet,” Drake said. “And it’s really frustrating to see that all these human beings making really cool sites that people want to go to are just not available on the default Windows search engine.”

https://arstechnica.com/tech-policy/2026/02/neocities-founder-stuck-in-chatbot-hell-after-bing-blocked-1-5m-sites/

Apple made Lockdown Mode for people at high risk

CART couldn’t get anything from the iPhone. “Because the iPhone was in Lockdown mode, CART could not extract that device,” the government filing said.

The government also submitted a declaration by FBI Assistant Director Roman Rozhavsky that said the agency “has paused any further efforts to extract this device because of the Court’s Standstill Order.” The FBI did extract information from the SIM card “with an auto-generated HTML report created by the tool utilized by CART,” but “the data contained in the HTML was limited to the telephone number.”

Apple says that LockDown Mode “helps protect devices against extremely rare and highly sophisticated cyber attacks,” and is “designed for the very few individuals who, because of who they are or what they do, might be personally targeted by some of the most sophisticated digital threats.”

Introduced in 2022, Lockdown Mode is available for iPhones, iPads, and Macs. It must be enabled separately for each device. To enable it on an iPhone or iPad, a user would open the Settings app, tap Privacy & Security, scroll down and tap Lockdown Mode, and then tap Turn on Lockdown Mode.

The process is similar on Macs. In the System Settings app that can be accessed via the Apple menu, a user would click Privacy & Security, scroll down and click Lockdown Mode, and then click Turn On.

“When Lockdown Mode is enabled, your device won’t function like it typically does,” Apple says. “To reduce the attack surface that potentially could be exploited by highly targeted mercenary spyware, certain apps, websites, and features are strictly limited for security and some experiences might not be available at all.”

Lockdown Mode blocks most types of message attachments, blocks FaceTime calls from people you haven’t contacted in the past 30 days, restricts the kinds of browser technologies that websites can use, limits photo sharing, and imposes other restrictions. Users can exclude specific apps and websites they trust from these restrictions, however.

https://arstechnica.com/tech-policy/2026/02/fbi-stymied-by-apples-lockdown-mode-after-seizing-journalists-iphone/

Now, Musk may be running out of arguments after Sooknanan shot down his First Amendment claims and other claims nitpicking the statute as unconstitutionally vague.

Whether Musk can defeat the SEC lawsuit without Trump’s intervention remains to be seen as the lawsuit advances. In her opinion, the judge found that the government’s interest in requiring disclosures to ensure fair markets outweighed Musk’s fears that disclosures compelled speech revealing his “thoughts” and “strategy.” Accepting Musk’s arguments would be an “odd” choice to break “new ground,” she suggested, as it could foreseeably impact a wide range of laws.

“Many laws require regulated parties to state or explain their purposes, plans, or intentions,” Sooknanan wrote, noting courts have long upheld those laws. Additionally, it seemed to be “common sense” for the SEC to compel disclosures “alerting the investing public to potential changes in control,” she said.

“The Court does not doubt that Mr. Musk would prefer to avoid having to disclose information that might raise stock prices while he makes a play for corporate control,” Sooknanan wrote. But there was no violation of the First Amendment, she said, as Congress struck the appropriate balance when it wrote the statute requiring disclosures.

Musk may be able to develop his arguments on selective enforcement as a possible path to victory. But Sooknanan noted that “despite having very able counsel,” his case right now seems weak.

In her opinion, Sooknanan also denied as premature Musk’s motions to strike from potential remedies the SEC requests for disgorgement and injunctive relief.

Likely troubling Musk, instead of balking at the potential fines, the judge suggested that “the SEC’s request to disgorge $150 million” appeared reasonable. That amount, while larger than past cases flagged by Musk, “corresponds to the Complaint’s allegation” that Musk’s violation of SEC requirements “allowed him to net that amount,” Sooknanan wrote.

“A straightforward application of the law reveals that none” of Musk’s arguments “warrant dismissal of this lawsuit,” Sooknanan said.

https://arstechnica.com/tech-policy/2026/02/trump-ghosts-musk-wont-back-claims-sec-lawsuit-was-political-harassment/

Senator Edward J. Markey (D-Mass.) demanded that Immigration and Customs Enforcement (ICE) confirm or deny the existence of a “domestic terrorists” database that lists US citizens who protest ICE’s immigration crackdown.

ICE “officers and senior Trump administration officials have repeatedly suggested that the Department of Homeland Security (DHS) is building a ‘domestic terrorists’ database comprising information on US citizens protesting ICE’s actions in recent weeks,” Markey wrote in a letter yesterday to Acting ICE Director Todd Lyons. “If such a database exists, it would constitute a grave and unacceptable constitutional violation. I urge you to immediately confirm or deny the existence of such a database, and if it exists, immediately shut it down and delete it.”

Creating a database of peaceful protesters “would constitute a shocking violation of the First Amendment and abuse of power,” and amount to “the kinds of tactics the United States rightly condemns in authoritarian governments such as China and Russia,” Markey said.

Markey’s letter said DHS officials “have repeatedly stated that the agency is engaged in efforts to monitor, catalog, and intimidate individuals engaged in peaceful protests,” and gave several examples. Trump border czar Tom Homan recently told Laura Ingraham on Fox News, “One thing I’m pushing for right now, Laura, we’re going to create a database where those people that are arrested for interference, impeding, and assault, we’re going to make them famous. We’re going to put their face on TV. We’re going to let their employers, and their neighborhoods, and their schools know who these people are.”

Markey’s letter called Homan’s comment “especially alarming given the numerous incidents in which DHS appears to have concluded that protesting ICE itself constitutes grounds for arrest.” Markey pointed to another recent incident in Portland, Maine, in which a masked ICE agent told an observer who was taking video that “we have a nice little database and now you’re considered a domestic terrorist.”

https://arstechnica.com/tech-policy/2026/02/capture-it-all-ice-urged-to-explain-memo-about-collecting-info-on-protesters/

UK probe moves ahead with “urgency”

X said in July 2025 that it was “in the dark” over what specific allegations it faced related to manipulation of the X algorithm and fraudulent data extraction. X said it would not comply with France’s request for access to its recommendation algorithm and real-time data about all user posts.

The Paris prosecutor’s office today said the investigation is taking a “constructive approach” with the goal of ensuring that X complies with French laws “insofar as it operates on national territory.” In addition to Musk and Yaccarino, the prosecutor’s office is seeking interviews with X employees about the allegations and potential compliance measures.

Separately, UK communications regulator Ofcom today provided an update on its investigation into Grok’s generation of sexual deepfakes of real people, including children. Ofcom is “gathering and analyzing evidence to determine whether X has broken the law” and is “progressing the investigation as a matter of urgency,” it said. Ofcom is not currently investigating xAI, the Musk company that develops Grok, but said it “continue[s] to demand answers from xAI about the risks it poses.”

The UK Information Commissioner’s Office (ICO), which regulates data protection, said today it opened a formal investigation into X regarding the “processing of personal data in relation to the Grok artificial intelligence system and its potential to produce harmful sexualized image and video content.”

“We have taken this step following reports that Grok has been used to generate non‑consensual sexual imagery of individuals, including children,” the ICO said. “The reported creation and circulation of such content raises serious concerns under UK data protection law and presents a risk of significant potential harm to the public.”

https://arstechnica.com/tech-policy/2026/02/x-office-raided-in-frances-grok-probe-elon-musk-summoned-for-questioning/

Amid the Trump administration’s attack on universities, Harvard has emerged as a particular target. Early on, the administration put $2.2 billion in research money on hold and shortly thereafter blocked all future funding while demanding intrusive control over Harvard’s hiring and admissions. Unlike many of its peer institutions, Harvard fought back, filing and ultimately winning a lawsuit that restored the cut funds.

Despite Harvard’s victory, the Trump administration continued to push for some sort of formal agreement that would settle the administration’s accusations that Harvard created an environment that allowed antisemitism to flourish. In fact, it had become a running joke among some journalists that The New York Times had devoted a monthly column to reporting that a settlement between the two parties was near.

Given the government’s loss of leverage, it was no surprise that the latest installment of said column included the detail that the latest negotiations had dropped demands that Harvard pay any money as part of a final agreement. The Trump administration had extracted hundreds of millions of dollars from some other universities and had demanded over a billion dollars from UCLA, so this appeared to be a major concession to Harvard.

Given Trump’s tendency to avoid any appearance of concession, his hostile response to the reports was unsurprising. Several hours after the Times published its article, he took to Truth Social to say the government would now seek $1 billion from Harvard. While he separately called the Times’ coverage “completely wrong” and demanded a correction, Trump also favorably quoted the part of the Times article that noted the government had continued to threaten Harvard’s funding despite having lost in court.

All this will likely give Harvard even more ground to argue that the government is being arbitrary and capricious, should the saga ever end up back in court.

https://arstechnica.com/tech-policy/2026/02/upset-at-reports-that-hed-given-up-trump-now-wants-1b-from-harvard/

Feb 03, 2026 Redazione news In evidenza, News, RSS, Tecnologia 0

---

Microsoft ha comunicato che l’autenticazione NTLM verrà disabilitata di default nelle future versioni, lasciando comunque il protocollo presente nel sistema operativo e riattivabile solo tramite policy quando davvero necessario.

Perché NTLM è un bersaglio: relay, replay e pass-the-hash

Il problema di NTLM non è soltanto la sua età, ma la sua esposizione a classi di attacchi che si innestano bene in ambienti enterprise moderni. Microsoft, e diversi esperti, citano esplicitamente relay, replay e man-in-the-middle come le “famiglie” di tecniche che diventano particolarmente pericolose quando un attore malevolo riesce a posizionarsi “in mezzo” a una conversazione di rete o a sfruttare autenticazioni legacy per muoversi lateralmente. In termini di tassonomie operative, il tema si collega a pattern noti come l’Adversary-in-the-Middle e il pass-the-hash, che continuano a comparire un po’ troppo spesso quando si fa la forensica di un attacco proprio perché “funzionano” quando l’azienda mantiene queste dipendenze.

La roadmap in tre fasi: audit, nuove capability Kerberos, poi blocco di default

Microsoft ha strutturato la transizione in tre fasi per ridurre il rischio senza provocare un blackout improvviso di applicazioni e servizi. La prima fase ruota attorno a capacità di auditing potenziate, già disponibili su Windows 11 24H2 e Windows Server 2025, utili a capire dove e perché NTLM viene ancora usato. La seconda fase, prevista per la seconda metà del 2026, introduce nuove funzionalità pensate per “chiudere” i buchi che oggi portano al fallback su NTLM, tra cui IAKerb e un Local Key Distribution Center (Local KDC). La terza fase è quella decisiva: nelle future release, l’NTLM di rete sarà disabilitato per impostazione predefinita, pur restando riabilitabile tramite policy per scenari legacy inevitabili.

 

“Disabilitato di default” non significa “rimosso”: cosa cambia operativamente

Microsoft sottolinea che non si tratta ancora della rimozione completa del protocollo, ma di una consegna del sistema in uno stato più sicuro “by default”, dove l’OS preferisce alternative moderne e Kerberos-based. Questo permetterà di usare NTLM ancora, ma sarà una scelta chiara dell’utente e non un possibile ripiego automatico in caso di sfruttamento di una vulnerabilità o un derivato di vecchie configurazioni di cui si è persa memoria.

In molte reti, infatti, l’uso di NTLM non è “intenzionale”, ma il risultato di condizioni che impediscono a Kerberos di funzionare come previsto. Microsoft, nella propria serie di hardening su Active Directory, entra nel dettaglio delle cause tipiche: problemi di connettività verso i domain controller, uso di account locali, errori o assenza di Service Principal Name (SPN), accesso alle risorse via indirizzo IP invece che tramite FQDN, oppure applicazioni configurate (o addirittura hardcoded) per chiamare NTLM. Ed è proprio qui che la roadmap prova a intervenire: IAKerb nasce per gestire scenari dove il client non ha una visione completa, mentre LocalKDC mira a ridurre l’uso di NTLM in autenticazioni basate su account locali, storicamente uno dei punti più difficili da eliminare.

Audit potenziato: visibilità prima del blocco

La parte più importante, oggi, è ottenere telemetria affidabile su dove NTLM sta ancora transitando. Microsoft indica esplicitamente che Windows 11 24H2 e Windows Server 2025 offrono auditing più ricco per identificare dipendenze e priorità di remediation, evitando di scoprire “a produzione ferma” che un pezzo di infrastruttura si appoggia ancora al legacy. Nella pratica, la stessa documentazione Microsoft enfatizza la necessità di mappare le dipendenze applicative e validare i workload critici con Kerberos, iniziando a testare configurazioni “NTLM-off” in ambienti non produttivi.

Questo implica un uso approfondito dei log: NTLM va trattato come un “debito tecnico misurabile”, non come un dettaglio di protocollo. Nei suggerimenti sull’hardening dello scenario, Microsoft cita famiglie di eventi utili a capire chi autentica, verso cosa e con quale versione negoziata; nelle build più recenti (24H2/Server 2025) compaiono anche eventi più dettagliati che aiutano a ricostruire il motivo del fallback e, in alcuni casi, il processo coinvolto. L’obiettivo operativo è trasformare l’eliminazione di NTLM in un percorso governato: riduzione progressiva, controllo dell’impatto e blocchi mirati dove non esistono più dipendenze.

NTLMv1: già fuori gioco, ma attenzione ai “derivati” e alle eredità crittografiche

Il percorso di dismissione è iniziato da tempo: NTLMv1 risulta già rimosso in Windows 11 24H2 e Windows Server 2025, ma restano casi in cui sopravvivono elementi di crittografia legacy. Microsoft descrive esplicitamente scenari in cui “rimasugli” di NTLMv1 possono ancora emergere, ad esempio in contesti legati a MS-CHAPv2 in ambienti domain-joined, e introduce chiavi di registro e log dedicati per passare da una modalità di audit a una di enforcement. La timeline pubblica include anche un punto rilevante: a ottobre 2026, in assenza di configurazione esplicita, il default può spostarsi verso una postura più restrittiva per specifici meccanismi collegati a derivati di NTLMv1.

---

---

---

https://www.securityinfo.it/2026/02/03/ntlm-verso-lo-switch-off-microsoft-si-prepara-a-bloccarlo-di-default/?utm_source=rss&utm_medium=rss&utm_campaign=ntlm-verso-lo-switch-off-microsoft-si-prepara-a-bloccarlo-di-default

“I am concerned that border patrol and other federal enforcement agencies now have my license plate and personal information, and that I may be detained or arrested again in the future,” she wrote. “I am concerned about further actions that could be taken against me or my family. I have instructed my family to be cautious and return inside if they see unfamiliar vehicles outside of our home.”

Cleland said she hasn’t performed any observation of federal agents since January 10, but has “continued to engage in peaceful protests” and is “assessing when I will return to active observations.”

We contacted the Department of Homeland Security about Cleland’s declaration and will update this article if we get a response.

Extensive use of facial recognition

Federal agents have made extensive use of facial recognition during President Trump’s immigration crackdown with technology from Clearview AI and a face-scanning app called Mobile Fortify. They use facial recognition technology both to verify citizenship and identify protesters.

“Ms. Cleland was one of at least seven American citizens told by ICE agents this month that they were being recorded with facial recognition technology in and around Minneapolis, according to local activists and videos posted to social media,” The New York Times reported today, adding that none of the people had given consent to be recorded.

ICE also uses a variety of other technologies, including cell-site simulators (or Stingrays) to track phone locations, and Palantir software to help identify potential deportation targets.

Although Cleland vowed to continue protesting and eventually get back to observing ICE and CBP agents, her declaration said she felt intimidated after the recent incident.

“The interaction with the agents on January 10th made me feel angry and intimidated,” she wrote. “I have been through Legal Observer Training and know my rights. I believe that I did not do anything that warranted being stopped in the way that I was on January 10th.”

https://arstechnica.com/tech-policy/2026/01/ice-protester-says-her-global-entry-was-revoked-after-agent-scanned-her-face/