Doctors and hospitals are condemning plans by UnitedHealthcare—the country’s largest health insurance company—to retroactively deny emergency medical care coverage to members if UHC decides the reason for the emergency medical care wasn’t actually an emergency.

In the future, if one of UHC’s 70 million members submits a claim for an emergency department visit, UHC will carefully review what health problems led to the visit, the “intensity of diagnostic services performed” at the emergency department (ED), and some context for the visit, like the member’s underlying health conditions and outside circumstances. If UHC decides the medical situation didn’t constitute an emergency, it will provide “no coverage or limited coverage,” depending on the member’s specific insurance plan.

Emergency medical doctors and hospitals were quick to rebuke the plan. They say it sets a dangerous precedent of requiring patients to assess their own medical problems before seeking emergency care, which could end up delaying or preventing critical and even lifesaving treatment.

The policy was initially set to take effect July 1. But in an email to Ars Thursday, UHC now says it is delaying the rollout amid the criticism—at least until the end of the pandemic.

“Based on feedback from our provider partners and discussions with medical societies, we have decided to delay the implementation of our emergency department policy until at least the end of the national public health emergency period,” a UHC representative told Ars in an email. “We will use this time to continue to educate consumers, customers, and providers on the new policy and help ensure that people visit an appropriate site of service for non-emergency care needs.”

Impossible prognosis

The delay is unlikely to ease critics’ concerns. After the policy was first announced last week, doctors were quick to note that assessing the necessity of emergency care before it’s actually given is nearly impossible. Many serious conditions have symptoms that overlap with nonserious conditions. For instance, chest pain may simply be a symptom of acid reflux or a panic attack, but it could also be a sign of a life-threatening heart attack. A bad headache could just be a bad headache, or it could signal a dangerous brain bleed.

In a 2018 analysis published in JAMA Open Network, researchers found that up to 90 percent of the symptoms that prompted an adult to go to the emergency room overlapped with symptoms of nonurgent conditions, which may be denied coverage in the future. But those same symptoms could also be linked to life-threatening conditions.

That analysis was spurred when the second-largest insurance company, Anthem, instituted a similar policy to UHC’s and began denying ED coverage.

In an accompanying editorial, one of the authors of the analysis—Maria Raven, chief of emergency medicine at the University of California, San Francisco—noted how problematic it is to retroactively evaluate emergency medical care. “My colleagues and I examined whether a patient’s symptoms at presentation to the ED could be labeled reliably as a non-emergency based on the discharge diagnosis—the diagnosis that Anthem is currently using to determine medical necessity,” she wrote. “We found it was impossible.”

Dr. Raven went on:

As emergency clinicians, we wait until after a workup to assign a discharge diagnosis: this workup is based on a detailed history and often involves blood work, imaging, and multiple hours of observation. That the same presenting symptoms that resulted in some patients going to the intensive care unit and others being denied coverage because the visit was considered unnecessary makes clear the impossibility of patients judging medical necessity.

“Strongly condemn”

In response to UHC’s planned policy, Richard Pollack, president of the American Hospital Association, echoed Raven’s point. In a public letter addressed to UHC’s CEO and dated June 8, Pollack wrote that “patients are not medical experts and should not be expected to self-diagnose during what they believe is a medical emergency. Threatening patients with a financial penalty for making the wrong decision could have a chilling effect on seeking emergency care.”

Overall, Pollack said the AHA is “deeply concerned” by the policy and urged UHC to “reverse the policy immediately.” The American College of Emergency Physicians released a similar response, saying the organization “strongly condemns” UHC’s “dangerous decision.” Like the AHA, the ACEP also noted that the policy may violate federal safeguards.

“ACEP firmly believes that the new policy is in direct violation of the federal Prudent Layperson Standard, which requires insurance companies to provide coverage of emergency care based on the presenting symptoms that brought the patient to the emergency department, not the final diagnosis,” the physicians’ group said in a statement.

Prior to telling Ars that it had decided to delay the policy, UHC had justified its plan by saying it was an effort to drag down healthcare costs.

In a statement to media outlet Fierce Healthcare, UHC wrote:

Unnecessary use of the emergency room costs nearly $32 billion annually, driving up healthcare costs for everyone. We are taking steps to make care more affordable, encouraging people who do not have a healthcare emergency to seek treatment in a more appropriate setting, such as an urgent care center.

Cost-cutting measure

But the AHA and ACEP both pushed back on this point, noting that there’s little evidence to suggest widespread misuse of emergency departments. AHA also suggested that a better way to bring emergency care costs down may be to provide members with better access and coverage to non-urgent care. Lastly, the hospital association suggested that the financial argument wasn’t a strong one coming from UHC, which has reported banner profits amid the pandemic.

“Despite implementing policies to restrict enrollee coverage over the past several years, UHC premiums continue to rise in most markets, as do UHC’s profits,” AHA wrote. “As you know, UHC’s parent company UnitedHealth Group posted a 35 percent year-over-year jump in operating profits in the first quarter of 2021. Despite earning $6.7 billion in a single quarter, UHC enrollees are being asked to pay more for their coverage.”

UnitedHealthGroup also earned $6.6 billion in the second quarter of 2020, which was double what it earned in the same period the year before.

ACEP President Mark Rosenberg was cynical in his response to UHC’s planned policy. In a statement, he said, “While we’re dismayed by United’s decision, we are not, unfortunately, surprised to see an insurance company once again try to cut its costs at the expense of necessary patient care.”

“You’re not going to pay”

For now, UHC’s members will be spared from ED claim reviews during the rollout delay. But even if the giant insurer never ends up instituting the policy, the damage may already be done. In 2018, after Anthem announced its similar policy to its members and began denying claims, it received similar backlash and challenges. Anthem ended up effectively rolling back the policy the same year and reversed decisions when members challenged claim denials.

Still, experts worried at the time that just the announcement of the policy—not its enforcement—would discourage some members from seeking care. Jonathan Kolstad, an associate professor at the Haas School of Business at the University of California, Berkeley told The New York Times in 2018: “You may get as much or more bang for your buck frankly by just telling people you’re not going to pay. Even if, at the end of the day, you do pay.”

https://arstechnica.com/?p=1772179

Facebook is the most commonly used social media platform for human sex trafficking recruitment in the US, according to a new report published by the Human Trafficking Institute.

Last year, 59 percent of victims in active cases who were recruited through social media were found through Facebook, the report states, with 41 percent of all recruitment taking place online.

“The Internet has become the dominant tool that traffickers use to recruit victims, and they often recruit them on a number of very common social networking websites,” Victor Boutros, CEO of the Human Trafficking Institute, told CBS News. “Facebook overwhelmingly is used by traffickers to recruit victims in active sex trafficking cases.”

The 2020 Federal Human Trafficking Report draws its data from active federal criminal and civil human trafficking cases. Last year, there were 579 active prosecutions and 200 civil suits. Among criminal cases, there were 1,499 victims and 1,007 defendants, and 94 percent of criminal prosecutions were for sex trafficking—only 6 percent were for forced labor.

Women and girls were overwhelmingly targeted by sex traffickers, with 98 percent of criminal cases involving female victims. Most victims—91 percent—were from the US, and a majority were burdened with pre-existing vulnerabilities, chiefly substance dependency or having run away from home.

Facebook was the most common platform for child recruitment, with the report noting that “65% of child victims recruited on social media were recruited through Facebook.” Those findings run counter to trends in teen usage of Facebook. Though around 70 percent of American adults frequent the site, it’s no longer the favored platform among teens—only 51 percent used the network, while YouTube, Instagram, and Snapchat took the top spots in a 2018 survey. Yet, the report says, “Despite Facebook’s reputation as a less popular platform among teenagers, it was a more common platform for recruiting child victims than adult victims in 2020 active sex trafficking cases.” 

“Sex trafficking and child exploitation are abhorrent, and we don’t allow them on Facebook,” Facebook spokesperson Jeanne Moran said in a statement to Ars. “We have policies and technology to prevent these types of abuses and take down any content that violates our rules. We also work with safety groups, anti-trafficking organizations, and other technology companies to address this, and we report all apparent instances of child sexual exploitation to the National Center for Missing and Exploited Children.”

After Facebook, the next most common venues for online socialization of child victims were Instagram and Snapchat. Among adult victims, WeChat was the most common, followed by Facebook and then Instagram. Just under half the active criminal cases researched in the report involved children; nearly all of the victims were between the ages of 14 and 17.

In 2020, the Internet was the most common venue for victim recruitment. In 244 cases across all ages, the Internet was the primary location, with recruitment on the street and at stores far behind, at 43 and 10 cases, respectively. Facebook was the primary location in 78 active cases. The Human Trafficking Institute points out that its report is not on the prevalence of human trafficking in the US but rather of cases being prosecuted at the federal level.

Part of the reason why the Internet—and likely Facebook by extension—is so prevalent in the report is because it only considers federal cases. In those cases, law enforcement appears to rely heavily on the Internet for its investigations. “The Internet is implicated in many sex trafficking situations, but the high numbers of federal prosecutions involving Internet solicitation are equally if not more reflective of the strategies law enforcement use to investigate these crimes,” the report says.

https://arstechnica.com/?p=1772081

The major record labels yesterday filed another lawsuit demanding that an Internet service provider terminate many more subscribers for alleged copyright violations.

Universal, Sony, and Warner sued Frontier Communications in US District Court for the Southern District of New York, alleging that the DSL and fiber ISP with 3.5 million subscribers “received hundreds of thousands of copyright infringement notices from copyright owners” but “provided known repeat infringers with continued access to and use of its network and failed to terminate the accounts of, or otherwise take any meaningful action against, those subscribers. In reality, Frontier operated its network as an attractive tool and safe haven for infringement.” Frontier “chose not to act on those notices and address the rampant infringement on its network,” the companies claimed.

Frontier said it “has terminated many customers about whom copyright owners have complained” and will fight the lawsuit.

The lawsuit was filed amid concerns that a $1 billion judgment against Cox Communications will cause ISPs to terminate more customer accounts and “punish the innocent and guilty alike,” as we reported Monday. Cox appealed the jury-issued penalty to the US Court of Appeals for the 4th Circuit, and its appeal received support from groups that are often on opposite sides of other major legal debates.

Consumer-advocacy groups and trade groups for ISPs urged the appeals court to overturn the ruling, saying that Internet providers are ill-suited to be copyright enforcers and that terminating subscribers is too harsh a penalty to be applied en masse. Cutting off residential Internet connections because of one subscriber deprives others using the same account in the same home of vital access to online services, consumer groups noted. The groups also pointed out that the lack of residential broadband competition in the US means that terminated subscribers will have trouble finding other service.

Three associations representing libraries joined the consumer groups in a court brief, arguing that cutting off an account because of the actions of one user “potentially cuts off every household member or—in the case of a school, library, or business—every student, faculty member, patron, and employee who shares the Internet connection.” Trade groups for ISPs also said the copyright-infringement notices sent by record labels to broadband providers are often too vague to act on.

“When these music companies sued Cox Communications, an ISP, the court got the law wrong,” the Electronic Frontier Foundation wrote. “It effectively decided that the only way for an ISP to avoid being liable for infringement by its users is to terminate a household or business’s account after a small number of accusations—perhaps only two.”

Cox’s appeal is also supported by the Internet Association, a lobby group for major websites including Amazon, eBay, Facebook, Google, Microsoft, Reddit, Spotify, and Twitter.

Lawsuit seeks $857 million, $300,000 per work

In yesterday’s lawsuit, the record labels said that the hundreds of thousands of copyright infringement notices sent to Frontier advised the ISP “of its subscribers’ blatant and systematic use of Frontier’s Internet service to illegally download, copy, and distribute copyrighted works through illicit BitTorrent sites and other online file-sharing services.” They claimed that Frontier “deliberately refused to take reasonable measures to curb its subscribers from using its service to infringe on the copyrights of others, including Plaintiffs, despite having direct knowledge of particular subscribers engaging in specific, repeated acts of infringement.”

The record labels describe Frontier providing Internet service in an ominous manner, writing that “Frontier has deliberately exploited the New York market, establishing network operations in this district, selling its services to over 80,000 New York households, and advertising its Internet service to potential subscribers in the state.”

As in the Cox case, the labels argue that Frontier is liable for “contributory” and “vicarious” copyright infringement. They ask for statutory damages of $300,000 for each of 2,856 works that were allegedly infringed—$150,000 for the contributory infringement and $150,000 for the vicarious infringement in each of the 2,856 cases. That adds up to nearly $857 million. In the Cox case, the jury awarded damages of $99,830.29 per work.

The labels filed an exhibit listing the 2,856 works by musicians such as 2Pac, 50 Cent, Amy Winehouse, Ariana Grande, Bon Jovi, Def Leppard, Drake, Elton John, Eminem, Ice Cube, Jay Z, Justin Bieber, Lana Del Rey, Lil Wayne, Ludacris, Nas, Nicki Minaj, Nine inch Nails, Nirvana, Rihanna, Rush, The Beatles, The Cranberries, The Police, The Rolling Stones, The Weeknd, Tom Petty, U2, Guns N’ Roses, UB40, Beyoncé, Bruce Springsteen, Carrie Underwood, Daft Punk, Elvis Presley, Journey, Korn, Leonard Cohen, Mariah Carey, Meghan Trainor, Michael Jackson, One Direction, Pink Floyd, Fleetwood Mac, Led Zeppelin, David Bowie, Wiz Khalifa, Dua Lipa, Prince, and various others.

“The use of Frontier’s network by its subscribers to copy and distribute infringing copies of Plaintiffs’ copyrighted works undercuts the legitimate music market, depriving Plaintiffs, and those recording artists whose works they sell and license, of the compensation to which they are entitled,” the lawsuit said.

Lawsuit calls broadband fees “illicit revenue”

Yesterday’s lawsuit claimed that Frontier is guilty of contributory infringement because it “facilitated, encouraged, and materially contributed to such infringement by continuing to provide its network and the facilities necessary for its subscribers to commit repeated infringements. Frontier had the means to withhold that assistance upon learning of specific infringing activity by specific users but failed to do so.”

The labels claimed that “Frontier marketed and promoted the high speeds of its network to attract those using peer-to-peer (‘P2P’) networks to infringe.” The labels’ claim of vicarious infringement alleges that “Frontier earned illicit revenue through user subscription fees that it would not have otherwise received from repeat infringers, as well as new subscribers drawn to Frontier’s services for the purpose of illegally downloading copyrighted works.”

The record labels also have a pending lawsuit against Charter Communications, the second-biggest home-Internet provider after Comcast. In that suit, the labels similarly claimed that high Internet speeds fuel piracy.

The idea that Internet subscribers choose specific ISPs because they allow copyright infringement—as opposed to simply taking what is often the only option for high-speed Internet access—was disputed by the groups supporting Cox’s appeal. The Internet Association wrote that account termination “prevents all the lawful uses of the Internet Cox enables” and that the “Internet is an essential and ubiquitous part of modern life… Termination of Internet access, with the consequences that entails, is not reasonable because it is a grossly disproportionate response to accusations of illegal downloading.”

A group representing Cox and other ISPs wrote in a court brief that the Internet “enables access to First Amendment-protected expression and information” and that “[i]t is unavoidable that some people will use Internet service for improper purposes, just as, once invented, telephones were used for wire fraud.”

Frontier said it will fight the lawsuit. “Frontier is not alleged to have done anything directly to infringe any copyright owner’s rights, and in fact has terminated many customers about whom copyright owners have complained,” the company said in a statement provided to Ars. “Frontier believes that it has done nothing wrong and will vigorously defend itself.”

https://arstechnica.com/?p=1771790

On Wednesday, El Salvador’s president signed into law a proposal to adopt bitcoin as legal tender, making the Central American nation the first in the world to officially use the cryptocurrency.

The new law says that companies must accept bitcoin as a form of payment, and the government will allow people to pay taxes with it as well. The exchange rate with the dollar will be set by the market, and exchanges from dollars to bitcoin won’t be subject to capital gains tax. The law was passed by a supermajority vote of the legislature, with 62 of 84 deputies assenting.

President Nayib Bukele said the new law would make it easier for Salvadorans living abroad to send remittances back to friends and family in the country. Some $6 billion in remittances flowed into the Salvadoran economy last year, accounting for nearly a quarter of the country’s gross domestic product. Around 70 percent of Salvadorans lack access to traditional banking and other financial services within the country, the president said. The 39-year-old leader hopes that sending remittances will become cheaper, too. Last year, the average fee was 3 percent per transaction. Eliminating that fee would net Salvadorans an additional $180 million.

The country has used the US dollar as its primary currency since 2001, when the government was attempting to stabilize and shore up an economy left in shambles by a bloody 12-year civil war that ended in 1992. The government switched its accounting system to dollars and stopped printing and minting its old currency, colones, though it did not remove it as legal tender. People can still spend any colones in their possession at a rate fixed to the dollar.

El Salvador’s use of the dollar as its primary currency has meant that the country has minimal control over its monetary policy; for all intents and purposes, the US Federal Reserve exerts more power. As a result, efforts by the Salvadoran government to prop up the economy in a recession must be through fiscal interventions, which require a supermajority in the legislature. Adopting bitcoin won’t change this situation, of course, since the supply of the cryptocurrency is limited by mining rates and is ultimately capped at 21 million bitcoins.

Bukele is hoping that by jumping on the bitcoin bandwagon, the country will attract investors. “#Bitcoin has a market cap of $680 billion dollars,” he wrote in a tweet. “If 1% of it is invested in El Salvador, that would increase our GDP by 25%.” That assumption, of course, is highly dependent on bitcoin’s market cap, which has fluctuated significantly over the last year as the cryptocurrency’s price has swung wildly.

Overnight, bitcoin prices are up around 7 percent, though they’re still off some 50 percent from their mid-April peak, when Tesla CEO Elon Musk criticized the cryptocurrency’s energy use and reversed course on accepting bitcoin for Tesla purchases. Musk’s decision was prompted in part by Ars’ coverage of a fossil fuel power plant in upstate New York that had been purchased by a private equity firm and tasked with mining bitcoin. Bitcoin’s energy use has skyrocketed in recent months and uses as much energy today on an annualized basis as the United Arab Emirates, or about 127 TWh per year. A single bitcoin transaction requires nearly 1,600 kWh to complete and produces an estimated 746 kg of carbon dioxide. 

That high energy use is baked into bitcoin’s design, which uses proof of work—computations of cryptographic hashes—to verify records and transactions on the blockchain. Other cryptocurrencies are either based on or planning to switch to other ways of maintaining the blockchain, including proof of stake, which requires users who validate the chain to hold a certain amount of the cryptocurrency, lowering the amount of energy use.

https://arstechnica.com/?p=1771727

The state of Ohio sued Google today in an unusual complaint that seeks a legal declaration that Google is a common carrier and public utility under Ohio law.

“Google uses its dominance of Internet search to steer Ohioans to Google’s own products—that’s discriminatory and anti-competitive,” Ohio Attorney General Dave Yost, a Republican, said when announcing the lawsuit. “When you own the railroad or the electric company or the cellphone tower, you have to treat everyone the same and give everybody access.”

The complaint was filed in the Common Pleas Court of Delaware County in Ohio. The lawsuit does not seek monetary damages but would impose certain nondiscrimination obligations on Google.

Yost’s requested declaration would say that Google “has a duty to carry content from other sources without unfair discrimination as compared to comparable Google content.” The suit also asks for a permanent injunction prohibiting Google “from prioritizing the placement of Google products, services, and websites on Results Pages from Google Searched [sic] in Ohio without providing equal opportunities for prioritization to non-Google entities.”

Clarence Thomas influence

“Ohio is the first state in the country to bring such a lawsuit,” Yost’s announcement said.

The lawsuit was influenced by Supreme Court Justice Clarence Thomas’ recent concurring opinion in which he argued that Twitter and similar companies could face First Amendment restrictions (even though they are not government agencies( and that free-speech law shouldn’t necessarily prevent lawmakers from regulating those platforms as common carriers.

“In many ways, digital platforms that hold themselves out to the public resemble traditional common carriers,” Thomas wrote. “Though digital instead of physical, they are at bottom communications networks, and they ‘carry’ information from one user to another. A traditional telephone company laid physical wires to create a network connecting people. Digital platforms lay information infrastructure that can be controlled in much the same way.”

Twitter’s banning of Donald Trump for inciting violence featured prominently in Thomas’ opinion, but he also wrote that common-carrier regulation could extend to Facebook and Google.

Yost’s lawsuit quotes from the part of Thomas’ opinion where he wrote, “[t]here is a fair argument that some digital platforms are sufficiently akin to common carriers or places of accommodation to be regulated… The analogy to common carriers is even clearer for digital platforms that have dominant market share… Google search—at 90 percent of the market share—is valuable relative to other search engines because more people use it, creating data that Google’s algorithm uses to refine and improve search results.”

Google: Don’t treat us like an electric company

Yost’s announcement argued that “Ohioans are harmed by Google because they cannot make the best choices if they don’t get all of the information. For example, if someone searches for a flight and Google returns its own presentation of search results to steer the person to Google Flights, the person doesn’t see offers from competitors such as Orbitz and Travelocity.”

Yost’s requested prohibition on Google prioritizing its own products, services, and websites above competitors on search pages would “extend to advertisements, enhancements, knowledge boxes, integrated specialized searches, direct answers and other features.”

Google said in a statement that “Google Search is designed to provide people with the most relevant and helpful results. AG Yost’s lawsuit would make Google Search results worse and make it harder for small businesses to connect directly with customers. Ohioans simply don’t want the government to run Google like a gas or electric company.”

Google also said, “[t]his lawsuit has no basis in fact or law” and that Google search doesn’t have any of the attributes of traditional common carriers such as railroads, phone companies, and energy providers. Those attributes include providing a standardized delivery service for a fee using public assets like rights-of-way, Google said.

Lawsuit isn’t “obviously right or wrong”

Yost’s lawsuit says that, under Ohio law, “[a]n entity may be characterized as a public utility if the nature of its operation is a matter of public concern and if membership is indiscriminately and reasonably made available to the general public.” Further, the lawsuit said that a corporation’s services reach “public utility or common carrier status when it serves a substantial part of the public in a way that makes its methods of operations a matter of public concern, welfare, and interest.”

“Pursuant to Ohio Revised Code Chapter 2721, the State is entitled to a judgment declaring Google’s Google Search to be classified as a common carrier and/or public utility, which subjects Google to the heightened duties that are required of such entities under common law,” Yost’s lawsuit said. The lawsuit also said that an entity can be a utility under Ohio law even if it is not regulated by the state Public Utilities Commission.

The lawsuit is novel but not “obviously right or wrong,” wrote Harold Feld, senior VP of consumer-advocacy group Public Knowledge and a longtime telecom lawyer with expertise in common-carrier law.

“I think Google’s best argument is that to be an effective search engine, it cannot treat all searchers and all data indifferently. It must ‘know’ facts about the individuals and make choices among the data as to what is responsive,” Feld wrote. “This sort of individualized treatment is usually the opposite of ‘indifferently’ or ‘indiscriminately’ (the two terms generally used to describe common carriers).” Feld stressed that the outcome “will depend on how Ohio interprets that phrase under common law.”

Google could ultimately appeal any adverse decision to a federal court and claim that it should be preempted by US law.

Dispute over “captured” clicks

Yost’s lawsuit also targets “captured clicks,” or “searches that ended either on the search engine result page or where a user clicked to other Google platforms, such as YouTube, Google Flights, Google Maps, Google News, Google Shopping, and Google Travel.” The complaint asks for a permanent injunction prohibiting Google “from including features on Results Pages from Google Searches conducted in Ohio that promote captured-click searches, without providing access to similar features to non-Google entities.”

Yost’s lawsuit said that about half of nonmobile Google searches in Ohio in 2019 were captured-click searches, while over 55 percent of mobile Google searches were in that category. Google has previously disputed claims that these searches, also called “zero-click,” make up the majority of Google searches. Google says that such claims rely “on flawed methodology that misunderstands how people use Search.”

Google wrote in March 2021:

People don’t always know how to word their queries when they begin searching. They might start with a broad search, like “sneakers” and, after reviewing results, realize that they actually wanted to find “black sneakers.” In this case, these searches would be considered a “zero-click”—because the search didn’t result immediately in a click to a website. In the case of shopping for sneakers, it may take a few “zero-click” searches to get there, but if someone ultimately ends up on a retailer site and makes a purchase, Google has delivered a qualified visitor to that site, less likely to bounce back dissatisfied.

https://arstechnica.com/?p=1771599

The Federal Bureau of Investigation created a company that sold encrypted devices to hundreds of organized crime syndicates, resulting in 800 arrests in 16 countries, law-enforcement authorities announced today. The FBI and agencies in other countries intercepted 27 million messages over 18 months before making the arrests in recent days, and more arrests are planned.

The FBI teamed up with Australian Federal Police to target drug trafficking and money laundering. They “strategically developed and covertly operated an encrypted device company, called ANOM, which grew to service more than 12,000 encrypted devices to over 300 criminal syndicates operating in more than 100 countries, including Italian organized crime, outlaw motorcycle gangs, and international drug trafficking organizations,” Europol said today.

Distribution of the devices began in October 2018. The cellphones sold by the FBI-run company were “procured on the black market” and “performed a single function hidden behind a calculator app: sending encrypted messages and photos,” The New York Times wrote today. The cellphones were “stripped of all normal functions,” with the faux calculator being the only working app. Once users entered a code, they could use the app to send messages that they thought were protected by end-to-end encryption.

“For years, organized crime figures around the globe relied on the devices to orchestrate international drug shipments, coordinate the trafficking of arms and explosives, and discuss contract killings, law enforcement officials said,” the Times wrote. “Users trusted the devices’ security so much that they often laid out their plans not in code, but in plain language.”

Unbeknownst to users, messages were routed to an FBI-owned server and decrypted with a master key controlled by the FBI.

Criminals sought extra security features

The operation was given the names “Trojan Shield” and “Greenlight.” Europol called it “one of the largest and most sophisticated law enforcement operations to date in the fight against encrypted criminal activities.”

But instead of getting backdoors installed into commonly used products—a step that Apple and other companies resisted because it would undermine security for all users—the FBI simply made and sold encrypted devices and monitored the devices’ communications. This was possible in part because criminal syndicates sought specific security features the FBI-run company provided, including remote wipe and duress passwords, Europol said.

FBI monitored messages and attachments

Anom’s website currently has a message saying, “This domain has been seized” and that “[l]aw enforcement has been monitoring messages and attachments from the ANØM platform. A number of investigations have been initiated and are ongoing.”

Here are more details on the operation from Europol’s announcement:

The goal of the new platform was to target global organized crime, drug trafficking, and money laundering organizations, regardless of where they operated, and offer an encrypted device with features sought by the organized crime networks, such as remote wipe and duress passwords, to persuade criminal networks to pivot to the device.

The FBI and the 16 other countries of the international coalition, supported by Europol and in coordination with the US Drug Enforcement Administration, then exploited the intelligence from the 27 million messages obtained and reviewed them over 18 months while Anom’s criminal users discussed their criminal activities.

This culminated in a “series of large-scale law enforcement actions [that] were executed over the past days across 16 countries resulting in more than 700 house searches, more than 800 arrests and the seizure of over 8 tons of cocaine, 22 tons of cannabis and cannabis resin, 2 tons of synthetic drugs (amphetamine and methamphetamine), 6 tons of synthetic drugs precursors, 250 firearms, 55 luxury vehicles and over $48 million in various worldwide currencies and cryptocurrencies,” Europol wrote. “Countless spin-off operations will be carried out in the weeks to come.”

Takedowns of other services helped Anom gain customers

Europol noted that there is “a huge demand for encrypted communication platforms” among criminal networks but that the market for encrypted devices is “volatile.” Law-enforcement takedowns of the EncroChat encrypted platform in July 2020 and the Sky ECC communication service tool in March 2021 helped agencies steer criminals toward the FBI’s own encrypted devices, Europol wrote:

Both operations provided invaluable insights into an unprecedented amount of information exchanged between criminals. After the takedown of Sky ECC in March 2021, many organized crime networks sought a quick encrypted replacement for a communication platform that would allow them to evade law enforcement detection. This was a deliberate and strategic aspect of OTF [Operational Task Force] Greenlight/Operation Trojan Shield resulting in the migration of some of the criminal Sky ECC customer base to the FBI-managed platform ANOM.

Secret master key

Vice published an in-depth story on Trojan Shield that draws from an unsealed court document containing an FBI affidavit and application for a search warrant. The 2018 arrest of Phantom Secure CEO Vincent Ramos, who sold encrypted phones to criminals, helped lead to the FBI operation. “In the wake of that arrest, a confidential human source (CHS) who previously sold phones on behalf of Phantom and another firm called Sky Global, was developing their own encrypted communications product,” Vice wrote.

As the court document states, the “CHS offered this next generation device, named ‘Anom,’ to the FBI to use in ongoing and new investigations.” The document also says that a master key was added to the encryption system used on each message:

Before the device could be put to use, however, the FBI, AFP [Australian Federal Police], and the CHS built a master key into the existing encryption system which surreptitiously attaches to each message and enables law enforcement to decrypt and store the message as it is transmitted. A user of Anom is unaware of this capability. By design, as part of the Trojan Shield investigation, for devices located outside of the United States, an encrypted “BCC” of the message is routed to an “iBot” server located outside of the United States, where it is decrypted from the CHS’s encryption code and then immediately re-encrypted with FBI encryption code. The newly encrypted message then passes to a second FBI-owned iBot server, where it is decrypted and its content available for viewing in the first instance.

The FBI paid the confidential source $120,000 for services and $59,508 for living and travel expenses, the document said.

FBI “push[es] the envelope” to fight encryption

The FBI has complained about encryption in consumer products for years, with one FBI official in 2018 reportedly calling Apple “jerks.” Today’s announcement demonstrates again that law enforcement has the ability to target criminals’ use of encrypted communications without making mass-market devices less secure.

“Encrypted criminal communications platforms have traditionally been a tool to evade law enforcement and facilitate transnational organized crime,” FBI Criminal Investigative Division Assistant Director Calvin Shivers said in the Europol announcement. “The FBI and our international partners continue to push the envelope and develop innovative ways to overcome these challenges and bring criminals to justice.”

https://arstechnica.com/?p=1771445

Amazon and Walmart are ramping up their efforts to grab market share in the $360 billion prescription drug market in the US.

Today, Amazon announced that Prime members can receive a six-month supply of several widely prescribed drugs, starting at $6. Many drugs are pricier but are still discounted relative to typical cash prices. And yesterday, Walmart said it would be adding new discounts of up to 85 percent on prescription drugs purchased through its Walmart+ RX service, with an average savings of about 65 percent.

The new announcements come as the retail behemoths have largely failed to disrupt the traditional pharmacy industry. Big names still dominate, with CVS and Walgreens topping the rankings by revenue. Walmart, which has a significant physical footprint for its pharmacies, comes in fifth. 

Amazon has yet to make a dent, not even cracking the top 15, and the e-commerce retailer’s ambitions have been further stymied by the fact that retail pharmacy locations have thrived recently relative to mail pharmacies. Though the company made waves last year with its announcement of Amazon Pharmacy—some analysts predicted that CVS and Walgreens would be hit hardest by the reveal—the company has been in the prescription drug business for years following its 2018 purchase of PillPack for $753 million. Amazon’s lack of traction in the market is upsetting the narrative that the e-commerce company dismantles every legacy business model it encounters. 

That could be why a report last month from Business Insider said that Amazon was looking at opening traditional pharmacies inside its more than 350 Whole Foods locations. But nothing has come of the idea so far, as starting a physical pharmacy is expensive. Each new Whole Foods location would need about three pharmacists and five technicians, in addition to changes in store layouts. 

It’s also hard for Amazon to get drugs for lower prices. Most wholesale purchases are made through pharmacy benefit managers (PBMs), which act as middlemen, using purchasing power to negotiate rebates and lower prices from drug manufacturers. PBMs then pass on a portion of those rebates to insurers, though smaller companies and insurers have claimed that they’re not seeing the same savings, which are hard to measure since the rebates are often secret. 

Pharmacies then sell to consumers, of course, but the billing differs depending on whether the customer has insurance. If so, the pharmacy charges one pre-negotiated rate and is reimbursed by the PBM at another, lower rate. If not, pharmacies charge the customer a predetermined “usual and customary” cash rate. These rates vary widely, and because PBMs won’t reimburse pharmacies above them, pharmacies have been setting relatively high usual and customary rates. That allows companies like Amazon, Walmart, and GoodRx to claim eye-popping discounts.

Both new plans from Amazon and Walmart allow customers to sidestep insurance altogether, but not PBMs. Walmart’s works much like a typical prescription drug plan. Customers apply for a “savings card” that looks like a prescription drug card issued by Walmart, usable only at its stores or its website. The retailer is working with a PBM, and it appears to be passing on a significant portion of the typical rebates to cash customers who would otherwise pay the higher usual and customary rate.

Amazon is doing the same thing, but it’s attempting to wring out more savings by sending customers drugs in bulk, reducing shipping and handling costs. Not all drugs are available in six-month supplies, and some that are cost significantly more than $6 per month. But some, including the diabetes medication metformin, are available for $1 per month. Customers can still opt to use their insurance if it ends up making the purchase cheaper.

This is Amazon’s second or third attempt to disrupt health care markets, depending on how you count. Its PillPack purchase fed into the company’s robot-enhanced image—the startup distinguished itself by using robots to package all of a customer’s prescription drugs into small daily packets. Amazon also tried to upend the health insurance industry years ago when it founded Haven along with companies like Berkshire Hathaway and JPMorgan. That effort ended in failure this February.

https://arstechnica.com/?p=1771407

The FBI said it has seized $2.3 million paid to the ransomware attackers who paralyzed the network of Colonial Pipeline and touched off gasoline and jet fuel supply disruptions up and down the East Coast last month.

In dollar amounts, the sum represents about half of the $4.4 million that Colonial Pipeline paid to members of the DarkSide ransomware group following the May 7 attack, The Wall Street Journal reported, citing the company’s CEO. The DarkSide decryptor tool was widely known to be slow and ineffective, but Colonial paid the ransom anyway. In the interview with the WSJ, CEO Joseph Blount confirmed that the shortcomings prevented the company from using it and instead had to rebuild its network through other means.

Cutting off the oxygen supply

On Monday, the US Justice Department said it had traced 63.7 of the roughly 75 bitcoins Colonial Pipeline paid to DarkSide, which the Biden administration says is likely located in Russia. The seizure is remarkable because it marks one of the rare times a ransomware victim has recovered funds it paid to its attacker. Justice Department officials are counting on their success to remove a key incentive for ransomware attacks—the millions of dollars attackers stand to make.

“Today, we deprived a cyber criminal enterprise of the object of their activity, their financial proceeds and funding,” FBI Deputy Director Paul M. Abbate said at a press conference. “For financially motivated cyber criminals, especially those presumably located overseas, cutting off access to revenue is one of the most impactful consequences we can impose.”

The Justice Department officials didn’t say how they obtained the digital currency other than to say they seized it from a bitcoin wallet through court documents filed in the Northern District of California. The seizure is a badly needed victory by law enforcement in its uphill effort to curb the ransomware epidemic, which is hitting governments, hospitals, and companies—many providing critical infrastructure or services—with increasing regularity.

The seizure is consistent with statements from almost four weeks ago attributed to a DarkSide team leader. Without providing evidence, the post claimed that the group’s website and content-distribution infrastructure had been seized by law enforcement, along with all the cryptocurrency it had received from victims.

If true, the seizure would represent a small fortune. According to recently released figures from cryptocurrency tracking firm Chainalysis, DarkSide netted at least $60 million in its first seven months starting last August, with $46 million of it coming in the first three months of this year. While corroborating that law enforcement has, in fact obtained that much is not possible, Monday’s disclosure shows it did receive at least some digital assets from DarkSide.

During Monday’s conference, Justice Department officials said they had tracked 90 victims who have been hit by DarkSide.

Paying by bitcoin rather than monero

Over the past year, ransomware has evolved from representing a financial risk to one that has the potential to disrupt critical services and cause loss of life. On several occasions, infections hitting hospitals caused outages that required the hospitals to cancel elective surgeries or reroute emergency patients to nearby facilities. Last week, JBS, the world’s biggest producer of meat, temporarily shut facilities throughout the US and elsewhere after it lost control of its network to a ransomware group known as REvil.

The law enforcement success intensifies speculation that Colonial Pipeline paid the ransom not to gain access to a decryptor it knew was buggy but rather to help the FBI track DarkSide and its mechanism for obtaining and laundering ransoms.

The speculation is reinforced by the fact that Colonial Pipeline paid in bitcoin, despite that option requiring an additional 10 percent added to the ransom. Bitcoin is pseudo-anonymous, meaning that while names aren’t attached to digital wallets, the wallets and the coins they store can still be tracked.

It’s possible that Colonial Pipeline chose to pay the higher ransom at the behest of law enforcement because bitcoin could be tracked and monero—the other currency accepted by DarkSide—is completely untraceable. Even if that is the case, it’s not clear how law enforcement gained possession of the cryptographic key needed to empty the wallet.

“As alleged in the supporting affidavit, by reviewing the Bitcoin public ledger, law enforcement was able to track multiple transfers of bitcoin and identify that approximately 63.7 bitcoins, representing the proceeds of the victim’s ransom payment, had been transferred to a specific address, for which the FBI has the ‘private key,’ or the rough equivalent of a password needed to access assets accessible from the specific Bitcoin address,” Monday’s release stated. “This bitcoin represents proceeds traceable to a computer intrusion and property involved in money laundering and may be seized pursuant to criminal and civil forfeiture statutes.”

With most of the ransomware groups headquartered in Russia or other Eastern European countries without extradition treaties with Western nations, US officials have largely been hamstrung in their efforts to bring the attackers to justice. It’s too early to know if the techniques that allowed the officials to track the funds Colonial Pipeline paid to DarkSide can be used in investigations of other ransomware attacks. If they do, law enforcement may have gained a powerful tool when it was needed most.

https://arstechnica.com/?p=1771171

A billion-dollar judgment in a piracy lawsuit involving a major Internet service provider could force ISPs to terminate more customer accounts and “punish the innocent and guilty alike,” advocacy groups have warned. Urging an appeals court to overturn the ruling, the groups wrote that “upholding this verdict would result in innocent and vulnerable users losing essential Internet access.”

These concerns were raised in a court filing last week by the Electronic Frontier Foundation (EFF), the Center For Democracy and Technology, the American Library Association, the Association of College And Research Libraries, the Association of Research Libraries, and Public Knowledge. The groups’ filing was made to the US Court of Appeals for the 4th Circuit in support of an appeal seeking to overturn a ruling in a case launched by record labels against Cox Communications.

“In going after Internet service providers for the actions of just a few of their users, Sony Music, other major record labels, and music publishing companies have found a way to cut people off of the Internet based on mere accusations of copyright infringement,” the EFF wrote in a blog post announcing the filing. “When these music companies sued Cox Communications, an ISP, the court got the law wrong. It effectively decided that the only way for an ISP to avoid being liable for infringement by its users is to terminate a household or business’s account after a small number of accusations—perhaps only two. The court also allowed a damages formula that can lead to nearly unlimited damages, with no relationship to any actual harm suffered. If not overturned, this decision will lead to an untold number of people losing vital Internet access as ISPs start to cut off more and more customers to avoid massive damages.”

A jury ruled in December 2019 that Cox must pay $1 billion in damages to the major record labels. Sony, Universal, and Warner had sued the cable ISP in 2018 in US District Court for the Eastern District of Virginia. A district judge upheld the verdict in January 2021, approving the $1 billion judgment and paving the way for to Cox appeal to the 4th Circuit.

“Dangerous consequences far beyond this case”

“The core question in this litigation is whether an Internet service provider (ISP) was sufficiently aggressive in terminating the accounts of thousands of subscribers, and if not, the consequences of that policy decision,” the advocacy groups wrote in their court brief. “The district court’s answer misconstrued the law, the actual relationship between ISPs and subscribers, and the public interest. Affirming it would have dangerous consequences far beyond this case.”

Terminating Internet service “means withdrawing an essential tool for participation in daily life,” and cutting off an account because of the actions of one user “potentially cuts off every household member or—in the case of a school, library, or business—every student, faculty member, patron, and employee who shares the Internet connection,” they wrote. “And with little or no competition among broadband ISPs in many areas of the country, those users may have no other way to connect.”

They continued:

Given this reality, the stakes of this case for Internet users are enormous. The district court’s judgment and the jury’s damage award in this case are founded on fundamental errors of law that, if affirmed, will force ISPs to terminate more subscribers with less justification or risk staggering liability. First, the judgment relies on unwarranted extensions of copyright’s two “secondary liability” doctrines, which will encourage ISPs to terminate subscribers when more proportionate means of addressing infringement exist. Second, the staggering and poorly justified $1,000,000,000 award of statutory damages against Cox thwarts basic principles of due process and the public interest.

Rightsholders routinely send copyright infringement notices to ISPs about their subscribers, based on IP addresses.

“As rightsholders file more cases against ISPs, those ISPs are also terminating subscribers more readily,” the groups’ court filing said. “More aggressive termination policies would punish the innocent and guilty alike. Unlike most accounts with edge providers, ISP subscriptions are shared by multiple users. For example, the record shows multiple instances of alleged infringement associated with accounts for universities, hospitals, local government agencies, and, in the case of subcontracted services, entire municipalities.”

The groups wrote that “Cox was rightly hesitant to terminate accounts like these.” But given the $1 billion judgment, “combined with the district court’s lower threshold for secondary liability, neither Cox nor other ISPs would hesitate again.”

“Even for residential accounts, the consequences of terminating Internet access will not be confined to individual repeat infringers,” the filing also said. “In other file sharing cases, rightsholders have estimated that 30 percent of the names of account holders identified as infringers were not responsible for the alleged infringement.”

The ruling could also cause ISPs to “be much less inclined to leave public Wi-Fi hotspots open in underserved neighborhoods, because doing so risks crushing liability,” the groups wrote.

Jury awarded damages of $99,830.29 per work

In its complaint against Cox, the record labels claimed that Cox “knowingly contributed to, and reaped substantial profits from, massive copyright infringement committed by thousands of its subscribers.” The ISP “deliberately refused to take reasonable measures to curb its customers from using its Internet services to infringe on others’ copyrights—even once Cox became aware of particular customers engaging in specific, repeated acts of infringement,” they claimed.

Despite receiving “hundreds of thousands of statutory infringement notices” from record labels, “Cox unilaterally imposed an arbitrary cap on the number of infringement notices it would accept from copyright holders, thereby willfully blinding itself to any of its subscribers’ infringements that exceeded its ‘cap,'” the record labels also argued.

At trial, the record labels “presented to the jury a total of 10,017 copyrights that Defendants’ subscribers allegedly infringed upon during the claim period” of February 2013 to November 2014, District Judge Liam O’Grady wrote when he approved the jury verdict. “The Court found during summary judgment proceedings that Plaintiffs owned all of the copyrights in suit within the meaning of the Copyright Act, and that Cox had sufficient knowledge of the alleged infringement to satisfy the knowledge element of the contributory infringement claim.” The jury ultimately “returned a verdict holding Cox liable for both vicarious and contributory infringement of all 10,017 claimed works,” and it awarded the plaintiffs statutory damages of $99,830.29 per work, for a total of $1 billion.

As the EFF and other groups wrote in their filing, plaintiffs asked the jury “to punish Cox for harms suffered by the entire content industry,” and the district court found that “consideration of industrywide harms justified an award many multiples higher than actual damages or lost profits, because copyright protection ‘is meant to achieve an important public interest.'”

https://arstechnica.com/?p=1771091

Google is paying a $268 million fine and, in a first, has agreed to overhaul its advertising platform to settle an antitrust probe in France.

After a two-year investigation, the French Competition Authority found that Google had used its ad-management platform for publishers to bolster its ad marketplace, where publishers sell inventory in real time. “Google took advantage of its vertical integration to skew the process,” said Isabelle de Silva, the authority’s president, at a press conference on Monday.

When publishers display ads on a site, they have two options. One is to run ads they’ve sold directly to advertisers. The other is to sell space to an exchange, where multiple advertisers bid to run their ads. In the latter case, known as programmatic advertising, publishers will often put ad space up for auction on multiple exchanges, but they’ll typically use only one ad server to coordinate the auctions and award-winning bids.

Google privileged its own services by allowing data to flow more freely between the manager, formerly known as DoubleClick for Publishers (DFP), and the exchange, formerly known as DoubleClick Ad Exchange (AdX), the authority claimed.

First, Google ensured that DFP worked better with AdX. DFP also shared key data with the exchange, like the price of winning bids. AdX then used that data to optimize future bids when competing with other ad exchanges.

Second, AdX returned the favor by working better with DFP. “The AdX platform is only partially interoperable with DFP’s competing ad servers and does not allow the latter to organize a competition between AdX and its competitors—even though AdX itself has a privileged access to a significant portion of advertisers’ demand and while all of these competitors have adopted standards allowing for fairer competition,” the authority said.

The ease with which the two sides of Google’s platform worked with each other “limited the attractiveness” of competing ad servers and managers, allowing the company to increase its market share, the authority said. Google merged DFP and AdX into one platform called Ad Manager in 2018.

Google acquired DFP and AdX when it bought DoubleClick in 2008 for $3.1 billion. When the acquisition was first announced in 2007, both the Federal Trade Commission and the European Union launched investigations, though both closed the inquiries after concluding that Google’s purchase wouldn’t reduce competition.

As part of the settlement announced today, Google made five commitments to the French Competition Authority, including a pledge to allow third-party platforms wider access to data. Google will also improve the way Google Ad Manager works with competing platforms, and it will no longer share competitors’ pricing data with AdX. An independent trustee will oversee the changes, which Google anticipates will begin rolling out in early 2022. The company also said “some” of the changes will be released globally, though it didn’t specify which or where those would surface.

Three publishers filed complaints with the authority, including News Corp. in 2019. The company has been a frequent antagonist of Google, Facebook, and other Big Tech platforms for years, arguing that they use unfair practices to boost their own ad products over those of publishers.

Big Tech firms like Google have come under increasing scrutiny in recent years as their revenues grow in tandem with their market power. France isn’t alone in investigating Google over concerns that it was abusing its position. In October, the US Department of Justice announced that it had filed an antitrust lawsuit against Google, alleging that it had forced rivals out of the search game.

https://arstechnica.com/?p=1770440