Texas’ deep freeze didn’t just disrupt natural gas supplies throughout Lone Star country—its effects rippled across the country, extending as far north as Minnesota. There, gas utilities had to pay $800 million more than they anticipated during the event, and Minnesota regulators are furious.

“The ineptness and disregard for common-sense utility regulation in Texas makes my blood boil and keeps me up at night,” Katie Sieben, chairwoman of the Minnesota Public Utility Commission, told The Washington Post. “It is maddening and outrageous and completely inexcusable that Texas’s lack of sound utility regulation is having this impact on the rest of the country.”

The gas and electric markets in Texas are lightly regulated and highly competitive, which has pushed companies to deliver energy at the lowest possible cost. But it also means that many companies were ill-prepared when the mercury dropped. To save money, they had skimped on winterizing their equipment. As a result, gas lines across the state—which has about 23 percent of the country’s reserves—quite literally froze. The spot price of natural gas soared to 70-times what it would normally be in Minnesota, and gas utilities paid a hefty premium when they used the daily market to match demand.

In a twist, the biggest gas utility in Minnesota is CenterPoint Energy, a Houston-based company that also supplies a large swath of Southeastern Texas. The company said it spent an additional $500 million on gas that week in February, and it has asked Minnesota’s utility commission for permission to add a surcharge to customers’ bills. The surcharge not only seeks to recoup the additional money CenterPoint spent on natural gas, it also includes 8.75 percent interest. The company expects that each customer would shoulder a burden of $300 to $400.

CenterPoint has told the Minnesota utility commission that the financial burden is so great that it would like to start billing customers in May rather than September, when such adjustments usually occur. Yet in public statements to investors, CenterPoint CEO David Lesar said that money wouldn’t be a problem.

“More importantly for our investors, we will not have to seek any incremental equity to handle our increased storm-related liquidity needs,” Lesar said in a February 25 earnings call. “As we have mentioned many times, we are fortunate to work in constructive regulatory jurisdictions and fully expect these costs to be recoverable in a timely manner. And in many of our jurisdictions, where these costs are the largest, we already have the ability to recover some carrying costs. We are in the process of working with all of our regulators on that.”

CenterPoint claims that beginning the surcharge in May will be beneficial to customers since the interest charges will be lower as soon as the company’s gas bill is paid off. Utilities are allowed to bill customers for legitimate expenses. The company appears to be planning similar requests in Arkansas and Oklahoma.

Minnesota’s other major natural gas utility, Xcel Energy, also said it will be seeking to recover its additional expenses from Texas’ deep freeze, but it wouldn’t be charging customers interest. Xcel estimates the interest charge would be around $25 million, while CenterPoint expects its charge will be $60 million.

https://arstechnica.com/?p=1759766

Apple is facing two class-action lawsuits over the meaning of the words “rent” and “buy.”

In the first suit, lead plaintiff David Andino argues that Apple’s definition of the two words is deceptive since the company can terminate people’s Apple IDs and, along with them, access to content they purchased using the “buy” button. Thus, Andino is arguing that Apple allows consumers to rent content rather than purchase it outright. If he had known that his access could be cut off at any time, he says he would have not spent as much on iTunes content.

“Just like Best Buy cannot come into a person’s home to repossess the movie DVD that such person purchased from it, [Apple] should not be able to remove digital content from its customers’ Purchased folders,” the suit says.

Apple countered by arguing that “no reasonable consumer would believe” that content purchased through iTunes would be available on the platform indefinitely. But US District Court Judge John Mendez wasn’t buying it, as first noticed by the Hollywood Reporter. He rejected a motion filed by Apple that sought to dismiss the suit. That means the suit can move forward with its claims of false advertising and unfair competition, though it could still be settled before going to trial. 

Apple is also up against a second class-action suit related to terminating Apple IDs. In this one, lead plaintiff Matthew Price claims he lost $24,590.05 in iTunes, the App Store, and in-app purchases, along with $7.63 in account credit, which became inaccessible when Apple terminated his account. Price’s lawsuit was filed on Tuesday.

Price’s $25,000 worth of purchases is perhaps an extreme example of what many consumers may encounter when they buy content on digital platforms, only to find it unavailable when their accounts are suspended or terminated. At issue is whether digital content available through various platforms is truly owned by individuals if the platform owner can prevent them from accessing it in the future. 

Amazon is defending itself against a similar lawsuit filed last April by people who claim the company falsely advertised that they would have unlimited access to content purchased through Prime Video. They are concerned that Amazon “secretly reserves the right to terminate the consumers’ access and use of the Video Content at any time,” the suit claims.

Prime Video and iTunes content can be downloaded and stored locally, but in many instances, purchased videos are streamed rather than downloaded. Apple and Amazon also advertise the fact that consumers can keep their purchased files in the cloud for later download. And when using certain settings on iOS and Fire devices, Apple and Amazon will automatically remove from a device content and apps that haven’t been accessed in a while, requiring the user to download them once more. 

In Price’s case, it’s hard to imagine that not happening—if all of his purchases were videos made on iOS devices, they would take up well over 1TB. No iPhone currently offers 1TB of storage, and iPad Pros only began offering that amount of storage in late 2018. Price opened his Apple account in January 2018. In the case of apps, the storage question is moot—if he had to restore his device, many of his apps and in-app purchases would have to be fetched from Apple’s servers.

For 4K videos sold through iTunes, there isn’t an option to download copies to store locally. Such content can only be streamed, no matter the device, though consumers can download HD versions. Similarly, some HDR content is only available for streaming, though Apple’s support document does not identify which videos that applies to. “You might be able to download Dolby Vision and HDR versions to your iOS, iPadOS, and macOS devices,” it says.

https://arstechnica.com/?p=1759745

The Trump administration effectively muffled scientific staffers at the Environmental Protection Agency when it rewrote automobile pollution rules, the agency’s watchdog said.

When drafting fuel economy and greenhouse gas pollution rules for cars and light trucks, former EPA Administrator Scott Pruitt decided to cede various EPA duties to the National Highway Transportation Safety Administration in what is typically a collaborative process, the independent inspector general said in a report released yesterday. Though Pruitt signed the final report for the EPA, he allowed NHTSA staff to write a significant portion of the rules and to complete all modeling and analysis for both agencies.

The NHTSA’s modeling efforts did not use the EPA’s established tools that had been created to evaluate greenhouse gas emissions standards. Instead, the NHTSA hacked its own Corporate Average Fuel Economy models and sent EPA experts the results late in the process. “Technical personnel were unable to fully collaborate on rule development,” the report said.

The EPA and the NHTSA have collaborated on fuel economy and emissions standards since 2010 in an effort to streamline and harmonize regulations for automakers. In rules written during the Obama administration, the EPA and NHTSA called for 5 percent annual increases in fuel economy. After Trump was elected, though, automakers wrote to his transition team to request that the annual increases be frozen. The Trump administration obliged, reviewing the rule and issuing a new one calling for 1.5 percent increases in fuel economy. The reason for the reduction, the Trump administration said, was that it would help keep auto prices lower, allowing consumers to buy newer, safer vehicles. Not everyone was convinced by that logic.

That the final rule included such a rationale is not surprising in light of the inspector general’s report. When making fuel economy rules, the Energy Policy and Conservation Act directs the NHTSA to consider four different variables—“technological feasibility, economic practicability, the effect of other government standards on fuel economy, and the need of the nation to conserve energy,” the report points out. None of those includes pollution or its effects.

The EPA, on the other hand, is the only agency that the Clean Air Act allows to regulate greenhouse gas emissions from new vehicles.

Career EPA staff, who are not political appointees, reportedly felt shut out of the process, a drastic departure from the previous four times they worked with the NHTSA to jointly issue pollution and fuel economy rules.

The inspector general’s report also noted that the EPA skipped major milestones in its rule-making process. According to the report, the agency “did not document who decided to skip these milestones and why.”

New EPA Administrator Michael Regan said he would be reviewing the Trump-era fuel economy standards and will release a revised rule by the end of July. The new rules could effectively phase out fossil fuel vehicles.

Stifling science

This latest report isn’t the only one to find fault with the way the Trump administration went about writing or rewriting environmental regulations. EPA political appointees also ordered career staff to scale back efforts to monitor ethylene oxide pollution in the Chicago area. The flammable gas is used to sterilize medical equipment, but it’s also a proven carcinogen.

Chicago EPA staff, barred from an official effort to document ethylene oxide pollution, installed air pollution-monitoring equipment outside an agency warehouse that abutted a large sterilization plant owned by Sterigenics, a major emitter of ethylene oxide. The scientists discovered that pollution from the plant was at such high levels that it significantly increased the cancer risk in the surrounding neighborhood by orders of magnitude, according to a report by the Chicago Tribune. The company couldn’t get the plant’s pollution under control and ultimately closed the site after significant opposition from the community.

The EPA is also undertaking a broader review of decisions in which the agency’s scientific integrity may have been compromised. Regan asked employees to bring “items of concern” to scientific integrity officials or the inspector general, who would investigate accordingly.

Trump administration officials at the Centers for Disease Control and Prevention are also under fire for their meddling in scientific affairs. Earlier this month, documents released to the public showed political appointees pushing for changes in how the CDC framed reports about COVID-19 and the agency’s Morbidity and Mortality Weekly Reports. The alterations helped frame the CDC’s reporting on the pandemic in terms that hewed more closely to then-President Trump’s rosy outlook.

https://arstechnica.com/?p=1759134

The state of Wisconsin has negotiated a dramatically scaled-back deal with Taiwanese contract manufacturer Foxconn. The move, announced Tuesday by Democratic Gov. Tony Evers, is a repudiation of a deal negotiated four years earlier by Evers’ Republican predecessor Scott Walker.

The original deal envisioned Foxconn spending as much as $10 billion to manufacture a state-of-the-art factory for manufacturing large liquid-crystal display panels. The deal was announced in 2017, and then-President Donald Trump traveled to Wisconsin for the 2018 groundbreaking, describing the new factory as “the eighth wonder of the world.” Foxconn was supposed to get $2.85 billion in state and local incentives under that original deal.

The deal may have been savvy politics for Foxconn in 2017. The company uses factories in other countries to assemble consumer electronics products for Apple and other American companies—products that are often then sent back to the United States for sale. So Trump’s protectionist inclinations seemed like a serious threat. Announcing plans to create of thousands of jobs in a key battleground state gave Trump something to boast about, and that may have helped Foxconn curry favor with the new administration.

But before long, it became clear that Foxconn wasn’t going to hold up its end of the bargain. The company was supposed to build a factory based on the LCD panel industry’s new Generation 10.5 standard, which uses enormous sheets of “mother glass” that are roughly 10 feet (3 meters) square. Each glass sheet is typically cut into several displays for use in large televisions. Making panels that large requires a large factory—the original deal envisioned Foxconn hiring as many as 13,000 workers in Wisconsin by 2032.

The new deal acknowledges that Foxconn’s presence in Wisconsin will be much smaller. The agreement asks Foxconn to spend only $672 million on a factory that will employ only 1,454 people by 2025. And the state will only offer Foxconn $80 million in incentives—a thirtyfold reduction from the original incentive package.

Evers described the new package as “a better deal for our state.” According to Reuters, Evers also “stressed that the incentives were in line with those available to any company.”

According to The Wall Street Journal, “The old contract required Foxconn to build a specific type of screen-making facility in Mount Pleasant, 25 miles south of Milwaukee.”

Now, Foxconn will have a greater ability to adjust its plans to changing market circumstances. Last month, Foxconn chairman Young Liu suggested that the company might manufacture electric cars in Wisconsin, though no specific plans have been announced.

https://arstechnica.com/?p=1759097

For years, Israeli digital forensics firm Cellebrite has helped governments and police around the world break into confiscated mobile phones, mostly by exploiting vulnerabilities that went overlooked by device manufacturers. Now, Moxie Marlinspike—creator of the Signal messaging app—has turned the tables on Cellebrite.

On Wednesday, Marlinspike published a post that reported vulnerabilities in Cellebrite software that allowed him to execute malicious code on the Windows computer used to analyze devices. The researcher and software engineer exploited the vulnerabilities by loading specially formatted files that can be embedded into any app installed on the device.

Virtually no limits

“There are virtually no limits on the code that can be executed,” Marlinspike wrote.

He continued:

For example, by including a specially formatted but otherwise innocuous file in an app on a device that is then scanned by Cellebrite, it’s possible to execute code that modifies not just the Cellebrite report being created in that scan, but also all previous and future generated Cellebrite reports from all previously scanned devices and all future scanned devices in any arbitrary way (inserting or removing text, email, photos, contacts, files, or any other data), with no detectable timestamp changes or checksum failures. This could even be done at random, and would seriously call the data integrity of Cellebrite’s reports into question.

Cellebrite provides two software packages: The UFED breaks through locks and encryption protections to collect deleted or hidden data, and a separate Physical Analyzer uncovers digital evidence (“trace events”).

To do their job, both pieces of Cellebrite software must parse all kinds of untrusted data stored on the device being analyzed. Typically, software that is this promiscuous undergoes all kinds of security hardening to detect and fix any memory-corruption or parsing vulnerabilities that might allow hackers to execute malicious code.

“Looking at both UFED and Physical Analyzer, though, we were surprised to find that very little care seems to have been given to Cellebrite’s own software security,” Marlinspike wrote. “Industry-standard exploit mitigation defenses are missing, and many opportunities for exploitation are present.”

Compromising integrity

One example of this lack of hardening was the inclusion of Windows DLL files for audio/video conversion software known as FFmpeg. The software was built in 2012 and hasn’t been updated since. Marlinspike said that in the intervening nine years, FFmpeg has received more than 100 security updates. None of those fixes are included in the FFmpeg software bundled into the Cellebrite products.

Marlinspike included a video that shows UFED as it parses a file he formatted to execute arbitrary code on the Windows device. The payload uses the MessageBox Windows API to display a benign message, but Marlinspike said that “it’s possible to execute any code, and a real exploit payload would likely seek to undetectably alter previous reports, compromise the integrity of future reports (perhaps at random!), or exfiltrate data from the Cellebrite machine.”

Marlinspike said he also found two MSI installer packages that are digitally signed by Apple and appear to have been extracted from the Windows installer for iTunes. Marlinspike questioned if the inclusion constitutes a violation of Apple copyrights. Apple didn’t immediately provide a comment when asked about this.

In an email, a Cellebrite representative wrote: “Cellebrite is committed to protecting the integrity of our customers’ data, and we continually audit and update our software in order to equip our customers with the best digital intelligence solutions available.” The representative didn’t say if company engineers were aware of the vulnerabilities Marlinspike detailed or if the company had permission to bundle Apple software.

Marlinspike said he obtained the Cellebrite gear in a “truly unbelievable coincidence” as he was walking and “saw a small package fall off a truck ahead of me.” The incident does seem truly unbelievable. Marlinspike declined to provide additional details about precisely how he came into possession of the Cellebrite tools.

The fell-of-a-truck line wasn’t the only tongue-in-cheek statement in the post. Marlinspike also wrote:

In completely unrelated news, upcoming versions of Signal will be periodically fetching files to place in app storage. These files are never used for anything inside Signal and never interact with Signal software or data, but they look nice, and aesthetics are important in software. Files will only be returned for accounts that have been active installs for some time already, and only probabilistically in low percentages based on phone number sharding. We have a few different versions of files that we think are aesthetically pleasing, and will iterate through those slowly over time. There is no other significance to these files.

The vulnerabilities could provide fodder for defense attorneys to challenge the integrity of forensic reports generated using the Cellebrite software. Cellebrite representatives didn’t respond to an email asking if they were aware of the vulnerabilities or had plans to fix them.

“We are of course willing to responsibly disclose the specific vulnerabilities we know about to Cellebrite if they do the same for all the vulnerabilities they use in their physical extraction and other services to their respective vendors, now and in the future,” Marlinspike wrote.

Post updated to add fourth- and third-to-last paragraphs and to add comment from Cellebrite.

https://arstechnica.com/?p=1759092

Hackers backed by nation-states are exploiting critical vulnerabilities in the Pulse Secure VPN to bypass two-factor authentication protections and gain stealthy access to networks belonging to a raft of organizations in the US Defense industry and elsewhere, researchers said.

At least one of the security flaws is a zero-day, meaning it was unknown to Pulse Secure developers and most of the research world when hackers began actively exploiting it, security firm Mandiant said in a blog post published Tuesday. Besides CVE-2021-22893, as the zero-day is tracked, multiple hacking groups—at least one of which likely works on behalf of the Chinese government—are also exploiting several Pulse Secure vulnerabilities fixed in 2019 and 2020.

Under siege

“Mandiant is currently tracking 12 malware families associated with the exploitation of Pulse Secure VPN devices,” researchers Dan Perez, Sarah Jones, Greg Wood, and Stephen Eckels wrote. “These families are related to the circumvention of authentication and backdoor access to these devices, but they are not necessarily related to each other and have been observed in separate investigations. It is likely that multiple actors are responsible for the creation and deployment of these various code families.”

Used alone or in concert, the security flaws allow the hackers to bypass both single-factor and multifactor authentication protecting the VPN devices. From there, the hackers can install malware that persists across software upgrades and maintain access through webshells, which are browser-based interfaces that allow hackers to remotely control infected devices.

Multiple intrusions over the past six months have hit defense, government, and financial organizations around the world, Tuesday’s post reported. Separately, the US Cybersecurity and Infrastructure Security Agency said that targets also include US government agencies, critical infrastructure entities, and other private sector organizations.”

Mandiant said that it has uncovered “limited evidence” that tied one of the hacker groups to the Chinese government. Dubbed UNC2630, this previously unknown team is one of at least two hacking groups known to be actively exploiting the vulnerabilities. Tuesday’s post said:

We observed UNC2630 harvesting credentials from various Pulse Secure VPN login flows, which ultimately allowed the actor to use legitimate account credentials to move laterally into the affected environments. In order to maintain persistence to the compromised networks, the actor utilized legitimate, but modified, Pulse Secure binaries and scripts on the VPN appliance. This was done to accomplish the following:

1. Trojanize shared objects with malicious code to log credentials and bypass authentication flows, including multifactor authentication requirements. We track these trojanized assemblies as SLOWPULSE and its variants.
2. Inject webshells we currently track as RADIALPULSE and PULSECHECK into legitimate Internet-accessible Pulse Secure VPN appliance administrative web pages for the devices.
3. Toggle the filesystem between Read-Only and Read-Write modes to allow for file modification on a typically Read-Only filesystem.
4. Maintain persistence across VPN appliance general upgrades that are performed by the administrator.
5. Unpatch modified files and delete utilities and scripts after use to evade detection.
6. Clear relevant log files utilizing a utility tracked as THINBLOOD based on an actor defined regular expression.

Mandiant provided the following diagrams showing the flow of various authentication bypasses and log access:

Tuesday’s blog post also referred to another previously unseen group that Mandiant is calling UNC2717. In March, the group used malware Mandiant identifies as RADIALPULSE, PULSEJUMP, and HARDPULSE against Pulse Secure systems at a European organization.

The company researchers added:

Due to a lack of context and forensic evidence at this time, Mandiant cannot associate all the code families described in this report to UNC2630 or UNC2717. We also note the possibility that one or more related groups is responsible for the development and dissemination of these different tools across loosely connected APT actors. It is likely that additional groups beyond UNC2630 and UNC2717 have adopted one or more of these tools. Despite these gaps in our understanding, we included detailed analysis, detection techniques, and mitigations for all code families in the Technical Annex.

Two years (and counting) of insecurity

Over the past two years, Pulse Secure parent company Ivanti has released patches for a series of Pulse Secure vulnerabilities that not only allowed remote attackers to gain access without a username or password but also to turn off multifactor authentication and view logs, usernames, and passwords cached by the VPN server in plain text.

During that same time span, the critical vulnerabilities have come under active attack by hackers and likely led to the successful ransomware attack on Travelex, the foreign currency exchange and travel insurance company that neglected to install the patches.

The Mandiant advisory is concerning because it suggests that organizations in highly sensitive areas still haven’t applied the fixes. Also concerning is the revelation of a Pulse Secure zero-day that is under wide attack.

Pulse Secure on Tuesday published an advisory instructing users how to mitigate the currently unpatched security bug. The Mandiant blog post contains a wealth of technical indicators that organizations can use to determine if their networks have been targeted by the exploits.

Any organization that’s using Pulse Secure anywhere in its network should prioritize reading and following the recommendations from both Mandiant and Pulse Secure.

https://arstechnica.com/?p=1758789

EU regulators have proposed strict curbs on the use of facial recognition in public spaces, limiting the controversial technology to a small number of public-interest scenarios, according to new draft legislation seen by the Financial Times.

In a confidential 138-page document, officials said facial recognition systems infringed on individuals’ civil rights and therefore should only be used in scenarios in which they were deemed essential, for instance in the search for missing children and the policing of terrorist events.

The draft legislation added that “real-time” facial recognition—which uses live tracking rather than past footage or photographs—in public spaces by the authorities should only ever be used for limited periods of time, and it should be subject to prior consent by a judge or a national authority.

The document comes as privacy advocates, politicians, and European citizens have become increasingly vocal about regulating the use of live facial recognition. At present, there are no clear rules around how and where the technology can be used on the general public, so the proposed legislation would be the first to codify these limitations into law.

The introduction of tougher curbs on the use of facial recognition technology would likely reignite debate over whether the practice should be banned altogether, as experts warn that it is still fraught with risks.

In a landmark ruling last August, the UK Court of Appeal said that the use of facial recognition technology by South Wales Police was unlawful and found that it breached privacy rights, data protection laws, and equality laws.

The EU’s draft legislation also addressed a range of related issues such as algorithmic bias, arguing that technology used in contexts such as recruitment and finance should be developed so as not to replicate “historical patterns of discrimination” against minority groups.

EU regulators proposed hefty fines of up to 6 percent of a company’s global turnover if it is found to have abused artificial intelligence in this way or fails to detect biases when hiring workers or providing services.

They added that so-called social-scoring practices, which assess a person’s trustworthiness from behavioral data gathered about them, should also be banned. In China, for instance, a system is being developed that calculates a person’s credit score using information about their online habits.

“The social score obtained… may lead to the detrimental or unfavorable treatment of [people or groups]… which are unrelated to the context in which the data was originally generated,” the leak said.

The proposals, which will be presented on Wednesday in Brussels, will now be debated by the European Parliament and member states until at least 2023 before becoming law.

© 2021 The Financial Times Ltd. All rights reserved Not to be redistributed, copied, or modified in any way.

https://arstechnica.com/?p=1758740

The PayPal-owned Venmo service will let users buy, sell, and hold bitcoin and other cryptocurrencies within the Venmo app, the company announced today. “Customers will have the ability to buy and sell cryptocurrency using funds from their balance with Venmo, or a linked bank account or debit card,” the announcement said.

Users will be able to buy or sell bitcoin, ether, litecoin, and bitcoin cash. The feature is rolling out to some users today and “will be available for all customers directly in the Venmo app within the next few weeks.”

When it becomes available, users can get started “by clicking on ‘Crypto’ in the Venmo menu at the top right in the app,” the announcement said. Crypto purchases can be made for as little as $1, but each purchase has a minimum fee of 50¢. Each user is limited to $20,000 in cryptocurrency purchases each week and $50,000 during each 12-month period.

The Venmo announcement did not say anything about paying for goods or services with cryptocurrency, but that ability could come to Venmo later. As CoinDesk wrote today, “PayPal opened trading on select cryptocurrencies to US customers last November and began allowing users to pay with crypto in March.” PayPal says that when users pay with cryptocurrency on PayPal, the service “automatically convert[s] it into USD or other currency at no additional fee.”

No peer-to-peer crypto transactions

At least for now, Venmo does not support peer-to-peer crypto trades or the ability to transfer cryptocurrency from one account to another. “Venmo only supports the purchase and sale of cryptocurrency using your Venmo account,” a Venmo FAQ says. “To complete P2P transactions with Venmo, all crypto assets held with Venmo must be sold and thus converted into USD.”

The ability to hold cryptocurrency in one’s Venmo account only applies to cryptocurrency purchased on Venmo, meaning you can’t transfer bitcoins or other cryptocurrency from other sources into Venmo.

The PayPal and Venmo crypto systems use the Paxos crypto brokerage service. “PayPal was also granted a first-of-its-kind conditional BitLicense by the New York State  Department of Financial Services (NYDFS), allowing PayPal and Venmo to offer its customers the ability to buy, sell, and hold cryptocurrency,” PayPal said.

Like PayPal, Venmo is enabling cryptocurrency purchases and sales throughout most of the US but not Hawaii, where the market has some regulatory restrictions. Venmo notes that “buying, selling, and holding cryptocurrencies is not regulated in many states, including the State of California.”

Crypto traders must verify identity

Venmo is not supporting cryptocurrency transactions for business profiles, limiting the ability to individual users. While anonymity is often seen as a key benefit of using cryptocurrency, Venmo notes that its crypto service is only available to US customers “who have verified their identity with Venmo.”

Venmo also pointed out that trading cryptocurrency “may result in significant losses.”

“Venmo will not cover losses from cryptocurrency price fluctuations and we recommend that customers make sure purchasing crypto is right for their individual financial situations,” the Venmo FAQ said. “Since crypto purchases and sales aren’t reversible, Venmo urges customers to do their research and make decisions carefully.” Venmo does promise that “cryptocurrency purchases are protected in the event unauthorized activity takes place.”

Venmo says its fees on crypto transactions generally range from 1.5 percent to 2.3 percent; fees are 1.5 percent on purchases or sales above $1,000; 1.8 percent on transactions between $200.01 and $1,000; 2.0 percent on transactions between $100.01 and $200; and 2.3 percent on transactions between $25 and $100. A 50¢ minimum fee is applied to transactions between $1 and $24.99.

https://arstechnica.com/?p=1758357

Parler is about to be re-platformed.

The app for the “free speech” social media company will be available once again on Apple’s App Store. Apple reinstated Parler on April 14, according to a letter from Apple to Sen. Mike Lee (R-Utah) and Rep. Ken Buck (R-Colo.), which was made public today. Once Parler releases an updated app, iOS users will be able to download it once more.

In the letter to Lee and Buck, Apple said that its App Store review team had spoken with Parler at length about how to bring the app into compliance with company guidelines. “As a result of those conversations, Parler has proposed updates to its app and the app’s content moderation practices,” wrote Timothy Powderly, Apple’s senior director of government affairs.

Parler was kicked off both Apple’s and Google’s app stores in the wake of the January 6 insurrection at the US Capitol, which left five people dead and hundreds more injured. Shortly thereafter, Amazon terminated hosting services for Parler. At the time, all three Big Tech firms said the social media company had not done enough to moderate posts that incited violence. Apple, in its letter, said it still stands by its decision to ban the app in January, and it made sure to point out that it reached that decision independently of Google and Amazon.

Google is reportedly open to allowing Parler back into the Google Play Store. In a statement made to Android Police following Apple’s reinstatement of the Parler app, the company said, “Parler is welcome back in the Play store once it submits an app that complies with our policies.”

Parler initially launched in August 2018, and its founders claimed it would be a “non-biased, free speech social media,” a pitch that pushed the false narrative that conservative voices were being censored on other social media platforms. It was founded by John Matze, Jared Thomson, and Republican political donor Rebekah Mercer. While the latter two remain, Matze was fired on January 30 in a brouhaha over implementing content moderation in an attempt to get Parler back into Apple’s and Google’s app stores.

Moderation on Parler reportedly was spotty at best. Parler reportedly alerted the FBI to threats made on the platform, but it apparently did little to remove them before the insurrection. The site’s rules forbid users from posting threats and criminal activity, but there was evidence of both. Unlike other social media platforms, there was limited automated moderation. Instead, the site relied more heavily on part-time paid “jurors” drawn from a pool of Parler users. Superficially, Parler takes a Twitter-style approach to social media. Posts are limited to 1,000 characters, and users can upload images to share with others.

In the wake of the riot, a hacker scraped and released nearly every post made on Parler, an archive of around 80 terabytes of data. The hack was relatively straightforward—Parler’s public API did not require any authentication, and posts were incremented numerically, allowing nearly anyone who knew of it to easily access reams of posts, images, and videos. The site didn’t scrub location data from images or videos, either, as other social media platforms often do, allowing anyone to quickly determine where the media was recorded.

Those images, videos, and location data have factored into investigations in the Capitol insurrection. Users left a digital trail of their activities inside the Capitol building, allowing law enforcement to identify and charge. One Parler user, Eduard Florea, was investigated for posting threats about Sen. Raphael Warnock (D-Ga.) and ultimately charged with illegal possession of ammunition.

https://arstechnica.com/?p=1758123

Last week, the Arkansas state House of Representatives passed a bill that would amend state education law to allow teachers in public schools to teach creationism as “a theory of how the earth came to exist.” As it stands, the act promotes blatantly unconstitutional behavior as made clear by a precedent set in a 1982 case involving the Arkansas Board of Education. Despite that, the bill passed 72-21, and it already has a sponsor in the state Senate.

The body of the bill is mercifully short, consisting of two sentence-long amendments to the existing Arkansas code:

A teacher of a kindergarten through grade twelve (K-12) science class at a public school or open-enrollment public charter school may teach creationism as a theory of how the earth came to exist.

This section is permissive and does not require a teacher to teach creationism as a theory of the earth came to exist.

But those two sentences are enough to land teachers and their local school system in a world of trouble, in that the permission given runs afoul of a lot of legal precedent. In a key case that involved Arkansas itself, McLean V. Arkansas Board of Education, a group of plaintiffs banded together to challenge a state law that mandated the teaching of “creation science” in public schools. The judge in that case correctly recognized that creation science was actually religious in nature, and it therefore violated the constitution’s prohibition against the establishment of state religion.

That ruling wasn’t appealed, meaning the legal precedent only applied to Arkansas. But later in that same decade, a similar case from Louisiana made it to the Supreme Court, and it reached the same conclusion. The prohibition against creation science has applied nationally since.

These precedents only apply to the teaching of creationism as science; there are other contexts, like a comparative religion class, where it might be appropriate to teach this idea. But the bill’s use of “theory” clearly indicates that it’s intended to insert the concept into science classes.

While the state might end up being sued if this law passes, it’s just as likely that a teacher in Arkansas will exercise this permission and the suit will end up targeting the teacher and the school board they work for. If the local school board loses (which it would), there is a good probability that it would end up liable for the legal fees of whoever sues. Thus, the legislation serves as an invitation for local school districts throughout the state to rack up enormous legal bills.

Although the legal history of creationism in schools is available to anyone with a working Internet connection, the bill passed with 72 representatives, all Republicans, voting in favor. Of the chamber’s 22 Democrats, 21 voted against it, and one other didn’t vote.

It’s not clear whether these legislators are simply unaware of the legal precedents or if they are simply using this bill as an opportunity to signal their cultural affiliations. We’ve contacted its two sponsors to find out. As of publication time, neither had responded.

https://arstechnica.com/?p=1757514