Both houses of Florida’s Republican-controlled legislature have passed new legislation banning social media companies from deplatforming political candidates or censoring large journalistic organizations. Gov. Ron DeSantis has expressed support for the bill and is expected to sign it into law.

Tech companies could be fined as much as $250,000 per day if they deplatform a statewide political candidate in the state. Critics argue that the bill is likely to be struck down as unconstitutional. That seems especially likely because the bill is broad and vaguely worded.

But at least one company won’t have to worry about the legislation: Disney. A last-minute amendment to the bill provides that it doesn’t apply to a “company that owns and operates a theme park or entertainment complex”—like Disney World.

In a Friday interview, Republican state Rep. Blaise Ingoglia, a bill sponsor, said the exemption was passed to make sure that the Disney+ streaming service “isn’t caught up in this.” The legislation applies to any service with more than 100 million users or at least $100 million in revenue. Disney+ has almost 100 million customers and far more than $100 million in annual revenue.

The bill focuses on conservative complaints about Big Tech

If you browse through the bill, the individual provisions are easy to connect to conservative complaints. Most obviously, many conservatives were outraged when Twitter and Facebook banned Donald Trump after the January 6 Capitol riot.

The bill also prohibits social media platforms from censoring “journalistic enterprises,” which are defined as an entity with more than 50,000 paid subscribers or 100,000 monthly active users. This rule may have been inspired by Facebook and Twitter’s controversial decision to censor a New York Post story about Hunter Biden’s emails.

The bill also regulates social media companies “shadow banning” users, a common conservative complaint. Sites must allow users to opt out of shadow banning and apply shadow-banning policies consistently. Social media services may not shadow ban political candidates or news sites.

The law prohibits “post-prioritization” of content related to candidates for public office. And the law defines post-prioritization to mean actions that “prioritize certain content or material ahead of, below, or in a more or less prominent position than others” in a newsfeed or “search results.” Taken literally, this seems to suggest that a search engine couldn’t rank results based on factors like relevance—at least not if they include a political candidate.

Get ready for constitutional challenges

Figuring out what these rules actually mean in practice will be tricky. Facebook uses a complicated algorithm to arrange the items in the News Feed because most users have enough friends that a strictly reverse-chronological news feed would be overwhelming.

If Facebook’s algorithm decides that a picture of a friend’s cat is more engaging than a post by a political campaign and shows that cat first, would that be an illegal act of “post-prioritization”? Taken literally, this seems to be what the law says. But that would mean Facebook had to dramatically redesign the News Feed.

Some critics argue that the very concept of the bill is unconstitutional—that deciding which content to publish and in what order are editorial decisions that are protected by the First Amendment. But even if you don’t buy that argument—and at least one Supreme Court justice doesn’t—the breadth and vagueness of Florida’s legislation might make it vulnerable to a constitutional challenge.

In rare cases where the courts have upheld speech restrictions, they’ve generally required laws to be clearly written and “narrowly tailored” to address a compelling government interest. Even if the First Amendment allows some regulation of online moderation decisions, the Florida bill does not seem either clear or narrowly tailored.

https://arstechnica.com/?p=1761665

At least five US federal agencies may have experienced cyberattacks that targeted recently discovered security flaws that give hackers free rein over vulnerable networks, the US Cybersecurity and Infrastructure Security Agency said on Friday.

The vulnerabilities in Pulse Connect Secure, a VPN that employees use to remotely connect to large networks, include one that hackers had been actively exploiting before it was known to Ivanti, the maker of the product. The flaw, which Ivanti disclosed last week, carries a severity rating of 10 out of a possible 10. The authentication bypass vulnerability allows untrusted users to remotely execute malicious code on Pulse Secure hardware, and from there, to gain control of other parts of the network where it’s installed.

Federal agencies, critical infrastructure, and more

Security firm FireEye said in a report published on the same day as the Ivanti disclosure that hackers linked to China spent months exploiting the critical vulnerability to spy on US defense contractors and financial institutions around the world. Ivanti confirmed in a separate post that the zeroday vulnerability, tracked as CVE-2021-22893, was under active exploit.

In March, following the disclosure of several other vulnerabilities that have now been patched, Ivanti released the Pulse Secure Connect Integrity Tool, which streamlines the process of checking whether vulnerable Pulse Secure devices have been compromised. Following last week’s disclosure that CVE-2021-2021-22893 was under active exploit, CISA mandated that all federal agencies run the tool

“CISA is aware of at least five federal civilian agencies who have run the Pulse Connect Secure Integrity Tool and identified indications of potential unauthorized access,” Matt Hartman, deputy executive assistant director at CISA, wrote in an emailed statement. “We are working with each agency to validate whether an intrusion has occurred and will offer incident response support accordingly.”

CISA said it’s aware of compromises of federal agencies, critical infrastructure entities, and private sector organizations dating back to June 2020.

They just keep coming

The targeting of the five agencies is the latest in a string of large-scale cyberattacks to hit sensitive government and business organizations in recent months. In December, researchers uncovered an operation that infected the software build and distribution system of network management tools maker SolarWinds. The hackers used their control to push backdoored updates to about 18,000 customers. Nine government agencies and fewer than 100 private organizations—including Microsoft, antivirus maker Malwarebytes, and Mimecast—received follow-on attacks.
In March, hackers exploiting newly discovered vulnerability in Microsoft Exchange compromised an estimated 30,000 Exchange servers in the US and as many as 100,000 worldwide.
Microsoft said that Hafnium, its name for a group operating in China, was behind the attacks. In the days that followed, hackers not affiliated by Hafnium began infecting the already-compromised servers to install a new strain of ransomware.
Two other serious breaches have also occurred, one against the maker of the Codecov software developer tool and the other against the seller of Passwordstate, a password manager used by large organizations to store credentials for firewalls, VPNs, and other network-connected devices. Both breaches are serious, because the hackers can use them to compromise the large number of customers of the companies’ products.

Ivanti said it’s helping to investigate and respond to exploits, which the company said have been “discovered on a very limited number of customer systems.”

“The Pulse team took swift action to provide mitigations directly to the limited number of impacted customers that remediates the risk to their system, and we plan to issue a software update within the next few days,” a spokesperson added.

https://arstechnica.com/?p=1761727

Internet service providers today sued New York to block a state law that requires ISPs to sell $15-per-month broadband plans to low-income households.

The lawsuit was filed by lobby groups including USTelecom and CTIA–The Wireless Association, both of which count Verizon and AT&T among their members. Lobby groups for many other ISPs also joined the lawsuit, with plaintiffs including NTCA–The Rural Broadband Association, the Satellite Broadcasting & Communications Association, and the New York State Telecommunications Association. The biggest cable lobby group, NCTA, did not join the lawsuit, but a cable lobby group representing small providers—America’s Communications Association—is one of the plaintiffs suing New York.

New York enacted its cheap-broadband law two weeks ago and called it a “first-in-the-nation requirement for affordable Internet for qualifying low-income families.”

With this law, New York “seeks to regulate broadband rates,” the ISPs’ complaint said. “A provision of the recently enacted New York State Fiscal Year 2022 Budget requires wireline, fixed wireless, and satellite broadband providers—no later than June 15, 2021—to begin offering to qualifying low-income consumers high-speed broadband service at a cost to consumers of $15 per month or higher-speed broadband service at a cost to consumers of $20 per month.” ISPs claim the state requirement is preempted by federal law.

Cuomo: “Bring it on”

The lawsuit was filed in US District Court for the Eastern District of New York. The broadband lobby groups asked for preliminary and permanent injunctions preventing enforcement of the law.

“I knew giant telecom companies would be upset by our efforts to level the playing field, and right on cue, they’re pushing back,” New York Gov. Andrew Cuomo said today. “Let me be abundantly clear—providing Internet in the Empire State is not a god-given right. If these companies want to pick this fight, impede the ability of millions of New Yorkers to access this essential service, and prevent them from participating in our economic recovery, I say bring it on.”

The state law requires $15 broadband plans with download speeds of at least 25Mbps, with the $15 being “inclusive of any recurring taxes and fees such as recurring rental fees for service provider equipment required to obtain broadband service and usage fees.”

ISPs can alternatively comply by offering $20-per-month service with 200Mbps speeds, and price increases would be capped at two percent per year. The state is required to review download speed requirements within two years and at least once every five years thereafter to determine whether they should be raised. Minimum upload speeds are not specified by the law.

Pai’s deregulation cited by ISPs

The ISPs claimed that New York’s law conflicts with the Federal Communications Commission decision, taken under then-Chairman Ajit Pai, to deregulate the broadband industry (and eliminate net neutrality rules in the process). The FCC deregulation order declared “that broadband is an interstate information service that should not be subject to common-carrier regulation,” the lawsuit said. “The Rate Regulation conflicts with that decision, as well as the Communications Act, by compelling providers to offer broadband on a common-carrier basis: at state-set rates and terms to all eligible members of the public.”

The ISPs also claimed that the low-income broadband law “intrudes into an exclusively federal field. More than a century ago, Congress enacted legislation that occupied the field of interstate communications service and, thereby, precluded states from directly regulating those services. In violation of that long-standing law, the Rate Regulation expressly seeks to set the rates and speed of an interstate communications service. No state has ever successfully engaged in such regulation.”

States can regulate broadband through consumer-protection powers, and New York will argue that its cheap-broadband requirement is not preempted by federal law. The broadband industry similarly claimed that a California net neutrality law is preempted by federal law, but US District Judge John Mendez in February rejected that argument and refused to give the industry a preliminary injunction blocking the California law.

The California case also involves a rate-regulation claim, as ISPs argue that California’s ban on ISPs charging online services for data-cap exemptions is improper rate regulation. While Mendez found that the California law isn’t rate regulation, the ISPs may have a better case in New York, where the state is requiring them to offer a specific plan at a specific price.

On the other hand, the Pai-led FCC’s abdication of its Title II regulatory authority over broadband reduced its power to preempt state laws. “[I]n any area where the Commission lacks the authority to regulate, it equally lacks the power to preempt state law,” the US Court of Appeals for the District of Columbia Circuit wrote in 2019, when it struck down Pai’s attempt to preempt all state net neutrality laws.

“AT&T/Verizon have sued to block NY’s broadband price regulation law and I am here to remind you the big ISPs did this to themselves,” Ernesto Falcon, senior legislative counsel for the Electronic Frontier Foundation, wrote on Twitter. “Lobbying to get rid of the FCCs authority invoked a counter push. They wanted to be unregulated monopolies and thought no one would stand against [them].”

https://arstechnica.com/?p=1761666

Germany’s top court struck down part of the nation’s sweeping climate law, saying it violates people’s freedoms. 

By many standards, the law is aggressive, requiring the country to slash emissions 55 percent below 1990 levels by 2030 and reach net zero by 2050. The country has already trimmed 35 percent of its carbon pollution, leaving just another 20 percent to be cut over the next nine years. And that’s where the court found fault with the law, saying that it left too much of the burden to future generations.

“The regulations irreversibly postpone high emission reduction burdens until periods after 2030,” the Constitutional Court wrote in a release explaining the ruling. 

The Climate Change Act, which was passed in 2019, sets reductions for six sectors of the economy, spanning energy, industry, transportation, buildings, agriculture, and everything else, including waste. Each sector has to meet an annual target, but those prescriptions end in 2030. Apart from an ill-defined end goal of net zero, the law says nothing about the period between 2031 and 2050.

The lawsuit was brought by a group of nine Germans, “some of whom are still very young,” the court noted. They claimed that the Climate Change Act would not move quickly enough to address climate change and, by not doing more, it would infringe on their freedoms and rights in the future.

A similar lawsuit in the US has been winding its way through the courts. First filed in 2015 on behalf of a group of children and teenagers, the suit accused the US government of violating the plaintiffs’ constitutional rights to life, liberty, and property by not taking stronger action on climate change. A federal appeals court “reluctantly” dismissed the case, saying the plaintiffs needed to work through legislative channels, and another appeals court refused to hear the case. The plaintiffs’ lawyers have said they would take the matter to the Supreme Court.

The German suit was brought on the basis of Article 20a in the country’s constitution, known as the Basic Law, which requires the government to protect people’s freedoms and the “natural bases of life.”

The court agreed with the plaintiffs in very clear terms. Because fossil fuels are still so entwined in daily life, and because the 2019 law doesn’t adequately prepare for significant emissions reductions after 2030, “these future obligations to reduce emissions have an impact on practically every type of freedom,” the court said.

“The verdict sends a very strong signal,” Peter Dabrock, a theologian and former chair of the German Ethics Council, told German broadcaster DW. “The freedom of the individual ends where the freedom of others begins,” he added, quoting the philosopher Immanuel Kant.

The court gave the German government until the end of next year to legislate how it plans to cut emissions beyond 2050.

https://arstechnica.com/?p=1761580

The European Commission today charged Apple with violating antitrust law, alleging that “it distorted competition in the music streaming market as it abused its dominant position for the distribution of music streaming apps through its App Store.”

The EC sent a Statement of Objections to Apple reflecting its preliminary conclusion that Apple violated European Union competition law. This kicks off a legal process in which Apple will be able to respond in writing and request an oral hearing before a final judgment is made. The EC took today’s action in response to a complaint from Spotify.

“If the case is pursued, the EU could demand concessions and potentially impose a fine of up to 10 percent of Apple’s global turnover—as much as $27 billion, although it rarely levies the maximum penalty,” according to Reuters.

The European regulatory body said it “takes issue with the mandatory use of Apple’s own in-app purchase mechanism imposed on music streaming app developers to distribute their apps via Apple’s App Store” and with Apple-imposed “restrictions on app developers preventing them from informing iPhone and iPad users of alternative, cheaper purchasing possibilities.”

Rules harm Apple Music competitors

The commission said it found that “Apple has a dominant position in the market for the distribution of music streaming apps through its App Store” and that it abused its dominant position by imposing rules on music streaming apps that compete against the Apple Music service.

“Our concern is that Apple distorts competition in the music streaming market to the benefit of Apple’s own music streaming service, Apple Music,” said EC Executive VP Margrethe Vestager, who is in charge of competition policy. Vestager said that “Apple deprives users of cheaper music streaming choices” by “charging high commission fees on each transaction in the App store for rivals and by forbidding [third-party app developers] from informing their customers of alternative subscription options.”

Meanwhile, “Apple Music is not subject to any of these rules and is offered at a price of typically 9.99 euros,” Vestager said. “We are concerned that Apple’s rules negatively impact its rivals by raising their costs, reducing their profit margins as well as their attractiveness on the Apple platform.”

EC: Two Apple rules created unfair advantage

The EC said its concerns about Apple “relate to the combination” of two rules “impose[d] in its agreements with music streaming app developers,” which the EC described as follows:

• The mandatory use of Apple’s proprietary in-app purchase system (“IAP”) for the distribution of paid digital content. Apple charges app developers a 30 percent commission fee on all subscriptions bought through the mandatory IAP. The commission’s investigation showed that most streaming providers passed this fee on to end users by raising prices.
• “Anti-steering provisions” which limit the ability of app developers to inform users of alternative purchasing possibilities outside of apps. While Apple allows users to use music subscriptions purchased elsewhere, its rules prevent developers from informing users about such purchasing possibilities, which are usually cheaper. The commission is concerned that users of Apple devices pay significantly higher prices for their music subscription services or they are prevented from buying certain subscriptions directly in their apps.

The EC noted that a “sending of a Statement of Objections does not prejudge the outcome of an investigation.” But if the allegations are confirmed, “this conduct would infringe Article 102 of the Treaty on the Functioning of the European Union (TFEU) that prohibits the abuse of a dominant market position,” it said. Apple has 12 weeks to formally respond to the EC, but there is no legal deadline for when the case has to finish, so it’s unclear how long it will take.

Apple will fight allegations

Apple, of course, disagrees with the EC and will fight the allegations.

“Spotify has become the largest music subscription service in the world, and we’re proud for the role we played in that,” Apple said in a statement it provided to Ars. “Spotify does not pay Apple any commission on over 99 percent of their subscribers, and only pays a 15 percent commission on those remaining subscribers that they acquired through the App Store.”

Spotify sells $9.99-per-month subscriptions directly to customers on its website, and a user who buys a subscription directly through Spotify can use that subscription on Apple devices by signing into the Spotify app. Spotify used to offer subscriptions through its iOS app for $12.99 a month, accounting for Apple’s cut, but stopped offering in-app purchases in 2016. A message in Spotify’s iOS app currently tells customers, “You can’t upgrade to Premium in the app. We know, it’s not ideal.”

Spotify pays Apple a 15 percent cut on subscriptions that customers started via in-app purchasing before Spotify disabled that capability. As Apple noted in a previous response to Spotify’s allegations, the typical cut of 30 percent is “for the first year of an annual subscription,” and “it drops to 15 percent in the years after.”

Apple is standing firm on its rule that music apps on iOS can’t tell customers about alternative methods of purchasing subscriptions.

“At the core of this case is Spotify’s demand they should be able to advertise alternative deals on their iOS app, a practice that no store in the world allows,” Apple said today. “Once again, they want all the benefits of the App Store but don’t think they should have to pay anything for that. The commission’s argument on Spotify’s behalf is the opposite of fair competition.”

Spotify founder and CEO Daniel Ek hailed the EC’s decision. “Today is a big day. Fairness is the key to competition,” he wrote on Twitter. “With the @EU_Commission Statement of Objections, we are one step closer to creating a level playing field, which is so important for the entire ecosystem of European developers.”

https://arstechnica.com/?p=1761521

Stock in Uber is down more than 6 percent after President Joe Biden’s new labor secretary, Marty Walsh, told Reuters that drivers are employees under US labor law.

Stock in Lyft, whose business is more concentrated in the United States, is down 11 percent. DoorDash, which heavily uses contract workers for food deliveries, saw its stock fall by 8 percent. The S&P 500 stock index is up slightly.

The legal status of workers driving for Uber, Lyft, and DoorDash has become a controversial issue around the world. The companies argue that the contractor model allows them to not only operate more efficiently but also offer drivers increased flexibility. Uber, Lyft, and DoorDash argue that if they were forced to pay drivers by the hour, the companies would have to not only raise fares but also restrict drivers’ hours to make sure drivers only work at times when there are enough customers to keep them busy.

But those arguments haven’t always persuaded policymakers. In 2019, California’s legislature passed legislation classifying gig workers as employees—though that law was overturned by a voter initiative last November. A New York federal judge ordered Uber to pay unemployment benefits to some Uber drivers last year. Uber faces a lawsuit over the issue in Massachusetts.

The Supreme Court in the United Kingdom ruled in February that Uber drivers are legally workers—a status between employees and contractors that doesn’t exist in the US. France’s top court ruled last year that Uber drivers are employees under French law. Spanish courts reached a similar conclusion in September. Uber is facing class-action lawsuits in Canada and South Africa over the same issue.

In the United States, the federal government and individual states each have their own laws related to worker rights. So in theory, a gig worker could be considered an employee under federal law but not state law or vice versa. Federal law also defines employees slightly differently for different types of rights and benefits—such as minimum wage protections or the right to organize. Walsh may not be able to re-classify gig workers with the stroke of a pen, but he and other Biden administration officials will have a lot of influence over how the law treats gig workers over the next four years.

For example, in 2019, the Trump-appointed general counsel of the National Labor Relations Board concluded that Uber drivers should not be treated as employees for the purposes of collective bargaining rights—a ruling that seems likely to be reversed under Biden. In March, the Biden administration proposed to reverse another rule adopted late in the Trump administration that made it easier for companies to classify workers as independent contractors.

On Wednesday, the Biden administration chose a prominent Uber critic, David Weil, to head the Department of Labor’s Wage and Hour Division—the agency that tries to ensure companies are paying workers minimum wage and overtime benefits. The post could give him an opportunity to challenge Uber’s and Lyft’s pay practices. We interviewed Weil for a piece on the rise of contracting last year.

https://arstechnica.com/?p=1761333

Enrollment for $50-per-month broadband subsidies for US residents with low incomes or those who lost income during the pandemic will begin on May 12, the Federal Communications Commission announced today. The FCC also set up a new website at which people can sign up for the subsidies.

“As of May 12, 2021, eligible households will be able to enroll in the program to receive a monthly discount off the cost of broadband service from an approved provider. Eligible households can enroll through an approved provider or by visiting https://getemergencybroadband.org,” the FCC said.

Congress approved the subsidies in December, but it took a few months for the FCC to set up the program. The FCC had previously said enrollment would begin at the end of April. Check out this list of providers to determine whether your ISP is participating in the discount program. There’s also a “Companies Near Me” tool that will become active closer to the May 12 start date.

“The Emergency Broadband Benefit Program will provide eligible households with discounts of up to $50 a month for broadband service, and up to $75 a month if the household is on Tribal lands. It also will provide a one-time discount of up to $100 on a computer or tablet for eligible households,” the FCC said.

The subsidies will not last indefinitely. They “will end when the fund runs out of money or six months after the Department of Health and Human Services declares an end to the COVID-19 health emergency, whichever is sooner,” the program website said. “Participating households will need to opt in to continue receiving broadband services from their provider after the program ends. If a household chooses to continue receiving service after the end of the Emergency Broadband Benefit Program, they will be billed the broadband provider’s general monthly rate.”

Congress provided $3.2 billion for the subsidies, and pending legislation would add another $6 billion to the emergency fund if it’s approved.

Multiple ways to qualify

Households with incomes at or below 135 percent of federal poverty guidelines qualify for the subsidy. As explained on the “Do I Qualify?” page, the subsidy is also available to households if any member of the household:

• Qualifies for Lifeline benefits through participation in SNAP, Medicaid, Supplemental Security Income, Federal Public Housing Assistance, or Veterans and Survivors Pension Benefit
• Participates in one of several Tribal-specific programs: Bureau of Indian Affairs General Assistance, Tribal Head Start (only households meeting the relevant income qualifying standard), Tribal Temporary Assistance for Needy Families (Tribal TANF), Food Distribution Program on Indian Reservations
• Experienced a substantial loss of income since February 29, 2020, with a total household income in 2020 at or below $99,000 for single filers and $198,000 for joint filers
• Received a federal Pell Grant in the current award year
• Received approval for benefits under the free and reduced-price school lunch program or the school breakfast program, including through the USDA Community Eligibility Provision, in the 2019-2020 or 2020-2021 school year
• Meets the eligibility criteria for a participating provider’s existing low-income or COVID-19 program, and that provider received FCC approval for its eligibility verification process

The FCC website explains how to apply and lists the documents people may need to provide to prove that they are eligible.

https://arstechnica.com/?p=1761308

In a Senate Judiciary Committee hearing yesterday, there was a striking change of scenery—rather than grilling the floating heads of Big Tech CEOs, senators instead questioned policy leads from Twitter, Facebook, and YouTube on the role algorithms play in their respective platforms. The panel also heard from two independent experts in the field, and the results were less theatrical and perhaps more substantive.

Both Democrats and Republicans expressed concerns over how algorithms were shaping discourse on social platforms and how those same algorithms can drive users toward ever more extreme content. “Algorithms have great potential for good,” said Sen. Ben Sasse (R-Neb.). “They can also be misused, and we the American people need to be reflective and thoughtful about that.”

The Facebook, YouTube, and Twitter execs all emphasized how their companies’ algorithms can be helpful in achieving shared goals—they are working to find and remove extremist content, for example—though all the execs admitted de-radicalizing social media was a work in progress.

In addition to policy leads from the three social media platforms, the panel heard from a couple of experts. One of them was Joan Donovan, director of the Technology and Social Change Project at Harvard University. She pointed out that the main problem with social media is the way it’s built to reward human interaction. Bad actors on a platform can and often do use this to their advantage. “Misinformation at scale is a feature of social media, not a bug,” she said. “Social media products amplify novel and outrageous statements to millions of people faster than timely, local, relevant, and accurate information can reach them.”

One of Donovan’s proposed solutions sounded a lot like community cable TV stations. “We should begin by creating public interest obligations for social media timelines and newsfeeds, requiring companies to curate timely, local, relevant, and accurate information.” She also suggested that the platforms beef up their content moderation practices.

The other panel expert was Tristan Harris, president of the Center for Humane Technology and a former designer at Google. For years, Harris has been vocal about the perils of algorithmically driven media, and his opening remarks didn’t stray from that view. “We are now sitting through the results of 10 years of this psychologically deranging process that have warped our national communications and fragmented the Overton window and the shared reality we need as a nation to coordinate to deal with our real problems.”

One of Harris’ proposed solutions is to subject social media companies to the same regulations that university researchers face when they do psychologically manipulative experiments. “If you compare side-by-side the restrictions in an IRB study in a psychology lab at a university when you experiment on 14 people—you’ve got to file an IRB review. Facebook, Twitter, YouTube, TikTok are on a regular, daily basis tinkering with the brain implant of 3 billion people’s daily thoughts with no oversight.

Apples and oranges

“What we need to do is compare what are the regulations and protections we apply in one domain and we’re not applying in a different domain,” Harris said.

The hearing quickly shifted to Section 230 of the Communications Decency Act, the reform of which has been mooted by members of both parties. One bill introduced last year would require platforms with more than 10 million users to obtain permission from people before serving them algorithmically tailored content. If the companies fail to do so, they would not receive protection under Section 230. Another bill would similarly revoke Section 230 immunity if algorithms spread misinformation that leads to violence.

The panel concluded by exploring alternative business models for social media platforms, ones that wouldn’t be as reliant on algorithms to drive engagement and ad views. Harris suggested that electric utilities might be one such model. Rather than encouraging people to leave their lights on all the time—which would make them more money but work against the societywide goal of energy conservation—regulations have been set up to discourage flagrant overuse, and a portion of the profits are put into funds to ensure the sustainability of the electric grid.

“Imagine the technology companies, which today profit from an infinite amount of engagement, only made money from a small portion of that,” he said. “And the rest basically was taxed to put into a regenerative public interest fund that funded things like the fourth estate, fact checkers, researchers, public interest technologists.”

https://arstechnica.com/?p=1761002

The oft-maligned F-35 program has run into another bit of turbulence. For years, Congress has authorized the Defense Department to purchase more F-35 Lightning II aircraft than the services had made budget requests for. But that largess appears to be coming to an end—just as the US Air Force starts to look for other ways to fill out its fighter squadrons.

In February, the Air Force lifted the curtains on plans to buy a brand-new aircraft to replace the F-16 Fighting Falcon. Air Force Chief of Staff Gen. C.Q. Brown said the service is looking at buying what he called a “clean sheet” fighter in 2023, using lessons learned from the efforts behind the recently acquired T-7A Red Hawk trainer. But that plan may have some difficulty taking flight because the Air Force was supposed to already have an F-16 replacement—the F-35A Lightning II.

The new fighter plan, which calls for an aircraft with some evolutionary improvements over aircraft like the current F-16 and F-18 Super Hornet, is essentially an acknowledgment by Brown and the Air Force that the F-35 program has failed to meet the Air Force’s goals of attaining what the service has sought since the 1970s: a balance referred to frequently by the late Senator John McCain as the “high-low mix.”

Mix it up

The “high-low mix” concept, born out of the group of Air Force reformers sometimes called the “Fighter Mafia“—Cols. John Boyd, Thomas Christie, Franklin “Chuck” Spinney, and Pierre Sprey—sought to fix the death spiral of fighter aircraft development cost and complexity by augmenting a few expensive, high-capability aircraft built for air superiority with a larger number of less-complicated and less-expensive aircraft that could handle basic air defense, strike missions, and close air support. In the 1970s, the “high” was the F-15 Eagle, and the “low” was the multirole F-16 Fighting Falcon. The Navy followed suit with the F-14 Tomcat as its “high” and the F/A-18 Hornet as a less-expensive “low.”

It’s hard to believe it now, but the F-35 was supposed to be the “low” to the Air Force’s F-22 Raptor “high.” Unfortunately, the F-22, initially designed in the 1980s, was too high—both in terms of the price for delivery and the ongoing maintenance and support costs, and production was shut down at just under 200 aircraft. And while the cost of the F-16 was less than half that of an F-15, the F-35 has roughly two-thirds the unit cost of the F-22—and the final price tag on the F-35 could be higher still.

In the middle

The problem is that the F-35 went from being the “low” to being something in between. And in the meantime, the F-16 has been repeatedly upgraded to make it into more of a middleweight air superiority fighter, even as more of the aircraft are shifted to reserve squadrons. The Air Force Reserve will need a fighter aircraft that can be easily and cheaply maintained to replace the F-16—and that certainly won’t be the F-35.

In a House Armed Services Committee hearing on April 22, members of the Subcommittees on Readiness and Tactical Air and Land Forces expressed deepening concerns about the long-term affordability of the F-35. Tactical Air and Land Subcommittee Chairman Donald Norcross (D-N.J.) said, “Given the overall affordability concerns that exist within the program, I would not support any requests for additional aircraft beyond what is contained in this year’s president’s budget request.”

Readiness Subcommittee Chair John Garamendi (D-Calif.) echoed that sentiment. Citing the F-35 program’s budget overruns and failure to deliver on its promised capabilities, Garamendi said that Congress would no longer throw more money at the F-35 program to fix it at taxpayers’ expense. “The easy days of the past are over,” he said.

Meanwhile, the “high” side of the equation has some holes in it, and the F-15 Eagle has been refeathered to fill the gap—with eight F-15EX on order and a few already delivered this year—to fill in those gaps. Maybe the replacement for the F-16 will have a familiar look to it as well.

Listing image by Wikimedia Commons

https://arstechnica.com/?p=1760136

Ransomware operators have delivered a stunning ultimatum to Washington, DC’s Metropolitan Police Department: pay them $50 million or they’ll leak the identities of confidential informants to street gangs.

Babuk, as the group calls itself, said on Monday that it had obtained 250GB of sensitive data after hacking the MPD network. The group’s site on the darkweb has posted dozens of images of what appear to be sensitive MPD documents. One screenshot shows a Windows directory titled Disciplinary Files. Each of the 28 files shown lists a name. A check of four of the names shows they all belong to MPD officers.

Other images appeared to show persons-of-interest names and photos, a screenshot of a folder named Gang Database, chief’s reports, lists of arrests, and a document listing the name and address of a confidential informant.

“Drain the informants”

“We advise [sic] you to contact us as soon as possible, to prevent leakage,” a post on the site says. “If no response is received within 3 days, we will start to contact gangs in order to drain the informants.”

In an email, MPD Public Information Officer Hugh Carew wrote: “We are aware of unauthorized access on our server. While we determine the full impact and continue to review activity, we have engaged the FBI to fully investigate this matter.” Carew didn’t answer questions seeking additional details about the breach.

In a videotaped message published on Tuesday night, Metropolitan Police Chief Robert J. Contee III said that with the assistance of local and federal partners, MPD has identified and blocked the mechanism that allowed the intrusion. He provided no new details about the breach or the ongoing investigation into it.

“Our partners are currently fully engaged in assessing the scope and impact,” he said. “In the course of the review, if it is discovered that personal information of our members or others was compromised, we will follow up with that information.”

The chief then went on to encourage people to “maintain good cyber hygiene.”

As bad as it gets

The incident underscores the growing brazenness of ransomware operators. Once content with merely locking up victims’ data and demanding a ransom in exchange for the key, they eventually introduced a dual-revenue model that charged for the key but also promised to publish sensitive documents online unless the ransom was paid. In recent weeks, at least one gang has started contacting customers and suppliers of victims to warn them their data may be spilled if the victims don’t pay up.

Threatening to identify confidential informants to organized criminal gangs—as Babuk appears to be doing now—hits a new low, said Brett Callow, a threat analyst who follows ransomware at security firm Emsisoft.

“That’s as bad as it gets,” he told Ars. “Can you imagine the potential for lawsuits if an informant were to be harmed as a direct result of the breach?”

Babuk is a relatively new ransomware enterprise that appeared in January. Not much is known about the group other than it has Russian-speaking team members, and Emsisoft researchers found a severe bug in the group’s decryptor software that caused data loss. The group’s darkweb site claims to have breached almost a dozen other companies.

Last week, a US Justice Department memo showed the agency convening a new task force to respond to the recent surge in ransomware attacks, particularly on hospitals and other critical US organizations. Acting Deputy Attorney General John Carlin will lead the task force, which is made up of agents and prosecutors from the FBI and Justice Department.

The leak might pose a threat not just to confidential informants but also to ongoing investigations. Federal prosecutors last year dropped narcotics charges against six suspects after crucial evidence was destroyed in a ransomware infection.

https://arstechnica.com/?p=1760792