Q Link Wireless, a provider of low-cost mobile phone and data services to 2 million US-based customers, has been making sensitive account data available to anyone who knows a valid phone number on the carrier’s network, an analysis of the company’s account management app shows.

Dania, Florida-based Q Link Wireless is what’s known as a Mobile Virtual Network Operator, meaning it doesn’t operate its own wireless network but rather buys services in bulk from other carriers and resells them. It provides government-subsidized phones and service to low-income consumers through the FCC’s Lifeline Program. It also offers a range of low-cost service plans through its Hello Mobile brand. In 2019, Q Link Wireless said it had 2 million customers.

The carrier offers an app called My Mobile Account (for both iOS and Android) that customers can use to monitor text and minutes histories, data and minute usage, or to buy additional minutes or data. The app also displays the customer’s:

• First and last name
• Home address
• Phone call history (from/to)
• Text message history (from/to)
• Phone carrier account number needed for porting
• Email address
• Last four digits of the associated payment card

Screenshots from the iOS version look like this:

No password required . . . what?

Since at least December and possibly much earlier, My Mobile Account has been displaying this information for every customer account whenever it is presented with a valid Q Link Wireless phone number. That’s right—no password or anything else required.

When I first saw a Reddit thread discussing the app, I thought for sure there was some kind of mistake. So I installed the app, got the permission from another thread reader, and entered his phone number. I was immediately viewing his personal information, as the redacted images above demonstrate.

The person who started the Reddit thread said in an email that he first reported this glaring insecurity to Q Link Wireless sometime last year. Emails he provided show that he notified support twice again this year, first in February and again this month.

Feedback left in reviews for both the iOS and Android offerings also reported this issue, in several cases with a response from a Q Link Wireless representative thanking the person for the feedback.

Downright negligence

The data exposure is serious because phone numbers are so easy to come by. We give them to prospective employers, car mechanics, and other strangers. And of course, phone numbers are easily obtained by private detectives, abusive spouses, stalkers, and other people who have an interest in a particular person. Q Link Wireless making customer data freely available to anyone who knows a customer’s phone number is an act of downright negligence.

I began emailing the carrier about the insecurity on Wednesday and followed up with almost a dozen more messages. Q Link Wireless CEO and founder Issa Asad didn’t respond despite my noting that every hour he allowed the data exposure to continue compounded the risk to his customers.

Then late on Thursday, My Mobile Account stopped connecting to customers’ accounts. When presented with the number of a Q Link Wireless customer, the app responds with a message saying, “Phone number doesn’t match any account.” The iOS and Android versions of the app were last updated in February, suggesting that the fix is the result of a change Q Link Wireless made to a server.

While My Mobile Account displayed customers’ personal information, it didn’t provide a means to change that data. The app also didn’t display passwords. That means a person couldn’t exploit this leak to perform a SIM swap or lock users out of their accounts, although the exposure might make it easier for a would-be SIM swapper to social engineer a Q Link Wireless employee into porting a number to a new phone.

There are no indications one way or the other that this leakage was actively exploited. Researchers from security firm Intel471 found no discussions in criminal forums about the available data, but there’s no way to know if it was abused on a smaller scale, say by someone a Q Link Wireless customer knows or has interacted with.

As phone users seeking low-cost, no-frills mobile service, Q Link Customers are a part of a population that may be least able to afford data breach services and other privacy services. The carrier has yet to notify customers of the data exposure. People using the service should consider any data displayed by the app to be available to anyone who has their phone number.

https://arstechnica.com/?p=1755853

Over 105,000 people have signed a petition urging President Biden to quickly break the Federal Communications Commission’s 2-2 deadlock between Democrats and Republicans.

Senate Republicans created the 2-2 deadlock in December 2020 by confirming a Trump nominee during the lame-duck session before Democrats took control of the White House and Senate. If not for that confirmation, the FCC would have had a 2-1 Democratic majority heading into Biden’s presidency. But with the FCC stuck in partisan deadlock, consumer advocates say that Biden must act quickly to add a Democratic commissioner.

The petition is on the Battle for the Net website operated by advocacy groups Fight for the Future and Demand Progress. The groups said:

The Federal Communications Commission is deadlocked, and will remain so until the Biden administration nominates, and the Senate confirms, a fifth commissioner. But we desperately need a functional FCC now: Millions of people are without reliable Internet access in the midst of a pandemic, kids are sitting outside Taco Bell to do homework, and people need to access information about how to get a vaccine. The Biden administration needs to nominate a fifth commissioner who doesn’t have ties to the telecom industry and will stand up to the ISPs, who supports reinstating net neutrality, and who will expand broadband and ensure everyone—especially low-income neighborhoods and communities of color who have experienced the greatest harm by the digital divide—has affordable access to the Internet.

Another version of the petition on the Free Press Action website says the “deadlock has put some of our most important work on hold,” such as “taking bold action to make Internet access more affordable and hold ISPs accountable for their abusive behavior” and “generally picking up the mess that Trump’s FCC chairman, Ajit Pai, left behind.”

Advocates also answered questions in a Reddit AMA yesterday.

Biden’s broadband plans

Right after taking office in January, Biden appointed Democratic Commissioner Jessica Rosenworcel to be the FCC’s acting chairwoman. To fill out the commission, Biden could add one commissioner and take the “acting” designation off Rosenworcel’s title of chairwoman, or he could make the as-yet-unnamed fifth commissioner the chair with Rosenworcel going back to her role as a member of the FCC.

Biden appears to be taking the nation’s broadband availability and affordability problems seriously. He proposed a $100 billion broadband plan that would build more publicly owned networks and prioritize “future-proof” networks instead of ones that would quickly become outdated. He also promised action to lower broadband prices and require ISPs to clearly disclose prices instead of obscuring the true cost of service by tacking on hidden fees not included in advertised rates. The cable industry is already lobbying against the plan, saying the US should favor private ISPs and take no action to lower prices.

Biden also hired Tim Wu, coiner of the term “net neutrality,” as special assistant for technology and competition policy. Still, the months without a 3-2 Democratic majority on the FCC could delay attempts to expand broadband availability and lower prices.

“There is a real cost to continued delay”

“I think it is simply a matter of priorities [for the Biden administration],” Harold Feld, a longtime telecom attorney who is senior VP of consumer advocacy group Public Knowledge, told Ars today. “It’s clear from the infrastructure package that they ‘get’ the importance of broadband. But it appears they haven’t freed up time at the top to settle on candidates and meet with people. Keep in mind that the president is going to want to meet with the future FCC chair, even if it’s Rosenworcel, before nominating. That’s standard protocol.”

But while Feld said the lack of a nomination during Biden’s first 11 weeks as president is “understandable,” he added that “there is a real cost to continued delay.” Once Biden nominates a new commissioner, the Senate will have to schedule hearings and confirmation votes, “which is going to be problematic to schedule once we get into the summer recess and then the final rush in the fall,” potentially leaving the fifth slot unfilled for most of 2021. Feld continued:

That’s basically a year lost on the ability to move forward on anything remotely controversial, or starting major new initiatives. That’s huge, particularly if either the House or Senate (or both) flips in 2022. As I say, it’s understandable given the multiple crises and the catastrophic damage done by the Trump Administration to the basic infrastructure of governance. But even if it’s understandable, it’s a trade-off with costs that need to be appreciated.

FCC has work to do, even with 2-2 deadlock

The deadlock means that Rosenworcel can’t pursue big initiatives that Republicans are certain to oppose, such as re-implementing net neutrality rules and reversing Pai’s deregulation of the broadband industry.

That doesn’t mean the Rosenworcel-led FCC won’t get anything important done, though. She is working on improving the accuracy of the FCC’s broadband-availability maps and implementing congressional mandates to distribute $50-per-month emergency broadband subsidies and a $7.17 billion Emergency Connectivity Fund that schools and libraries will use to help people get Internet access at home.

Biden’s nominations so far include antitrust scholar Lina Khan to the Federal Trade Commission; gun-control advocate David Chipman to lead the Bureau of Alcohol, Tobacco, Firearms and Explosives; and Rohit Chopra to lead the Consumer Financial Protection Bureau. Biden still needs to nominate another Democrat to the FTC to ensure a 3-2 majority because Chopra is an FTC commissioner and would have to leave that role when confirmed by the Senate to lead the CFPB. There are also unfilled slots at various other federal commissions.

“White House inherited several crises”

Free Press VP of Policy and General Counsel Matt Wood agreed with Feld that the lack of an FCC nominee so far is understandable, telling Ars, “this White House inherited several crises from the last president of international and historical scale, and has moved to tackle many of them all at once.”

Wood continued:

Groups like Free Press and our allies have made clear how important it is to get the FCC back to full strength, to keep implementing the good new laws Congress has passed in the last six months and to do the agency’s work of treating broadband like an essential telecom service once again. But while we still want—and need—a stellar nominee for that final spot at the FCC as soon as possible, it’s hard to fault the administration for hiring in its own team first and moving the American Jobs Plan announced last week in tandem with all of these important appointments.

Additionally, given the level of “expertise in the acting chairwoman’s office,” the White House may “rightly believe” that filling up the FCC “is a slightly less pressing priority than repairing the damage done at other agencies by the Trump years,” Wood said.

https://arstechnica.com/?p=1755851

The US has placed Chinese groups accused of building supercomputers to help the Chinese military on an export blacklist, the first such move by the Biden administration to make it harder for China to obtain US technology.

Three companies and four branches of China’s National Supercomputing Center were added to the US government “entity list,” which bars American companies from exporting technology to the groups without a license.

The US commerce department said the groups were involved in building supercomputers used by Chinese “military actors” and facilitating programs to develop weapons of mass destruction.

“Supercomputing capabilities are vital for the development of many—perhaps almost all—modern weapons and national security systems, such as nuclear weapons and hypersonic weapons,” said Gina Raimondo, the US commerce secretary.

She said the administration would use “the full extent of its authorities to prevent China from leveraging US technologies to support these destabilizing military modernization efforts.”

The Chinese entities are Tianjin Phytium Information Technology, Shanghai High-Performance Integrated Circuit Design Center, Sunway Microelectronics, and the National Supercomputing Center branches.

The US is concerned about China gaining access to American technology that helps the People’s Liberation Army close the gap with the US military and field weapons that could alter the balance of power in the Indo-Pacific.

The Washington Post this week said Phytium designed semiconductors using US technology to power supercomputers being employed to develop hypersonic missiles, which are hard to detect because of their speed.

The newspaper said Phytium used technology from Cadence Design Systems and Synopsys. The entity list move would effectively prevent the two California-based companies from providing services and products to the Chinese firms. But it would not bar them from supplying the Chinese groups if that technology were produced in facilities outside of the US.

The Washington Post said Phytium outsourced the manufacturing of its chips to TSMC, the Taiwanese company that has become the world’s most advanced semiconductor manufacturer.

The Financial Times previously reported that the Trump administration had pressed the Taiwanese government to restrict TSMC from producing chips for Huawei, which it said were being used in Chinese missiles.

Placing the Chinese groups on the entity list also does not bar TSMC from supplying them with chips since the US did not employ the “foreign direct product rule”—which would ban any foreign company that uses US technology, such as TSMC, from exporting to Phytium or the other groups.

The Trump administration used that rule to implement tough export controls related to Huawei in a move that closed previous loopholes.

Michael McCaul, the top Republican on the House foreign affairs committee, welcomed the move to put Phytium on the entity list but said it was only a “half-measure” because the foreign direct product rule was not invoked.

“The lessons we learned from the loopholes in the Huawei entity listing must be incorporated as standard operating procedures for our export control policy to ensure they are truly effective,” McCaul said.

But Lindsay Gorman, a technology expert at the German Marshall Fund, said that by using a tool that was frequently employed by his predecessor, Biden had “put to bed” any sense that he would not be tough on China.

“It was an open tool whether a favored tool of the Trump administration would be continued in the Biden administration,” Gorman said.

Trump put dozens of Chinese companies on the entity list, including Huawei, the telecoms equipment manufacturer, and Semiconductor Manufacturing International Corporation.

The Biden administration is reviewing dozens of China-related actions that Donald Trump took in his last year in office, including an order that prohibits Americans from investing in Chinese companies that the Pentagon says help the People’s Liberation Army. The US is also talking to allies in Asia and Europe to try to find ways to coordinate export controls.

© 2021 The Financial Times Ltd. All rights reserved Not to be redistributed, copied, or modified in any way.

https://arstechnica.com/?p=1755695

When Edward Koll and his girlfriend, Jo Narkon, bought and moved into a new house in Draper, Virginia in late September 2020, they had every reason to think that Comcast Internet would be readily available.

They had done their due diligence before buying the house, plugging the address into the Comcast website to make sure it had cable Internet and contacting Comcast directly to make extra sure. Both the Comcast website’s availability checker and a Comcast sales rep confirmed to them that the house had service.

But Comcast had given the couple false information because of an error in its coverage map, and it didn’t tell the couple about this mistake until after they bought the house. That was over six months ago, and Koll and Narkon still don’t have home Internet service.

“It wasn’t until after we closed on the house that Comcast finally notified us that we were in a ‘dead zone,'” Koll told Ars when he first contacted us on February 12, 2021. “The ends of our street are hooked up, but the middle where we live does not have the service pedestal.”

This wasn’t the first time that Comcast, the nation’s largest cable company, has falsely told customers that service would be available.

Even though it was Comcast’s fault, the company demanded $5,000 up front to extend its network to Koll and Narkon’s house. The couple eventually paid up in late November after determining it was the only viable option. But while Comcast initially promised service within 90 days of receiving the $5,000 payment, it failed to complete the project in that time frame.

Comcast now says the project will finally be completed by April 15, over six weeks after the original 90-day estimate passed on March 2. The couple has been using mobile hotspots for Internet access the entire time they’ve lived in the house because of Comcast providing false availability information and then failing to complete the installation on time.

Comcast: “[We] did not live up to our standards”

Comcast seemed to take the problem more seriously after Ars contacted the company’s public relations department, eventually promising a $5,000 credit.

“Mr. Koll’s experience did not live up to our standards and we are very sorry for the inconvenience this has caused, therefore, we will be applying a credit to his account equal to $5,000,” Comcast told Ars on March 29, after a few weeks of back-and-forth communication.

“The shocking part of it was Comcast’s refusal to even own this,” Koll told Ars in a phone interview last week, after Comcast agreed to the $5,000 credit. “They just kind of brushed it off and we really did not get any traction on this until we reached out to you [at Ars].”

A Comcast rep called the couple yesterday to confirm that service will be installed on Thursday, April 15, sometime between 8am and 10am, Koll told us. Even after that call, Koll said he is “not convinced” the project is far enough along to be finished by then. But they’ve ordered Internet, TV, and phone service, and the couple is switching their cell phones over to Comcast’s mobile service. The total price is estimated at $249 a month, Koll said. At that price, the $5,000 credit will last about 20 months. Virginia is one of the states where Comcast reluctantly agreed to delay data-cap enforcement until 2022.

No option but to pay $5,000

Between emails, phone calls, and in-person visits, Koll said he had dozens of contacts with Comcast over the past six months to try to sort the mess out. “Comcast said, ‘yeah, our agents told you that service was available and they promised you that it was right there at your doorstep, but they were wrong,'” Koll said.

One installer arrived at the house and “said, ‘I need to go find out where your service line is,’ and then he disappeared. He never came back,” Koll told Ars. “And then we had two other installers and there was finally the third guy who said, ‘You don’t have a service pedestal close enough and you’re looking at a hefty bill just to have it installed.'”

After hearing Comcast’s demand for $5,000, Koll complained to the FCC but the agency “followed up with Comcast and accepted their explanation without comment,” Koll told Ars. Koll said he also contacted the offices of US Sens. Tim Kaine (D-Va.) and Mark Warner (D-Va.) without any results.

Gigabit Internet “is available for your address”

Koll provided Ars a copy of the $5,000 invoice dated November 30 along with chat and email transcripts from conversations he had with Comcast.

In an online chat before they bought the house, Koll asked a Comcast rep to verify that gigabit Internet service and cable TV would be available. The rep told him that “the Gigabit Speeds Internet plan is available for your address” and that a 2-year contract would cost “$169.99/mo plus equipment, taxes, and fees.”

The rep told Koll to order service five to eight business days in advance in case cable needed to be run to the house, making it sound like it would be an easy process and not a six-month ordeal. But the Comcast rep was wrong because Comcast’s system was providing false information. Koll placed an order for Comcast service over the phone on August 25, and the couple closed on the house on September 24, moving in the same day. Even when accepting the order, Comcast didn’t realize that it hadn’t extended its network close enough to the house to provide service.

On November 1, 2020, Koll replied to an email from a Comcast rep in the executive customer relations department, and pointed out that Comcast’s service map showed his address as having service. Koll’s email also pointed out that he had placed an order for service on August 25 “and at the same time put a deposit into the account so that service would be installed on or before closing on this house.”

“Given the multiple assurances from Comcast for service and the lengthy delays we have already endured, I anticipate a quick resolution to this matter,” Koll wrote in that email.

But there was no quick or cheap resolution. “We reluctantly agreed to pay $5,000 in November to have the service pedestal installed despite Comcast’s earlier promises regarding existing service availability,” Koll told Ars, months later.

“We really need help”

Koll first contacted us after reading one of our articles about a 90-year-old AT&T customer, Aaron Epstein, who bought an ad in the Wall Street Journal to complain about AT&T’s slow Internet service. At the time, Koll wasn’t sure that Comcast would install service at all.

“We really need help, similar to Mr. Epstein,” Koll told Ars in his first email to us. “We need to get the service we were promised installed. We would like to have the $5,000 back, but at this point are willing to accept that as a credit towards future bills. Comcast has offered two free months, which does not come close to the amount we have paid.”

Although Comcast later agreed to a credit equal to the full amount they paid, the company did not tell us why it won’t refund the $5,000 instead of providing it as a bill credit. That essentially means they had to pay $5,000 in advance for about 20 months of service, an initial expense that new Comcast customers normally would not have to pay.

Comcast fixes map, months too late

In late March, Comcast finally updated its coverage map and online availability checker to correctly show Koll’s address as unserved. So why did Comcast’s website and a Comcast sales rep falsely tell Koll that service was already available at the home?

“This is not a common occurrence and we have to look into these instances on a case-by-case basis,” Comcast said. “For this specific address, it was included in a database from a company we acquired many years ago. Our local teams are planning a further review of that regional database.”

Cable companies have failed for years to develop more accurate service maps. The cable industry’s biggest lobby group fought against requirements to submit address-level data to the Federal Communications Commission, telling the FCC in 2017 that it’s too difficult and expensive to figure out exactly where they can and can’t offer service.

The FCC finally ordered ISPs to submit geospatial maps of where they provide service in 2019, but then-FCC Chairman Ajit Pai did not finish setting up the new system before leaving office in January 2021. Upon taking over from Pai, Acting FCC Chairwoman Jessica Rosenworcel learned “that we had a lot of work to do and hadn’t yet begun many of the steps required to actually build a collection system,” she wrote.

https://arstechnica.com/?p=1755494

A closely watched effort to unionize an Amazon fulfillment center in Bessemer, Alabama, appears to be headed for defeat. With about half the votes counted, 1,100 workers have voted against forming a union, while only 463 voted in favor.

The National Labor Relations Board is counting the 3,215 votes that were cast by workers at the Bessemer facility. The union needs to win at least half the votes in order to become the official representative of the roughly 6,000 workers at the Bessemer facility. Counting has ended for the evening and is scheduled to resume at 8:30 am Central Time on Friday.

The stakes are high for both Amazon and the labor movement. Amazon has more than 1.1 million workers overall, with hundreds of thousands working in fulfillment centers. A successful vote in Bessemer would embolden labor organizers at other Amazon fulfillment centers around the country. An organized workforce could force dramatic changes in the way Amazon manages its warehouses.

“We first started to talk about unionizing one day during a break,” said Jennifer Bates, a worker at the Bessemer warehouse who helped organize the union drive, during March Senate testimony. “People were upset about the breaks being too short and not having enough time to rest, about being humiliated to have to go through security checks.”

Amazon mounted an aggressive campaign against unionization. The company posted anti-union literature all over its facilities, including in bathroom stalls. Employees were required to attend regular meetings where Amazon presented anti-union arguments.

Union elections are ordinarily held in person, but this one was held by mail due to coronavirus concerns. As a result, a close election could lead to months of legal wrangling over which ballots were cast by eligible workers. But if the current two-to-one margin holds up, the union may have to concede quickly.

That isn’t to say organizers are going to give up.

“Our system is broken,” said Stuart Appelbaum, the president of the Retail, Wholesale and Department Store Union that led the organizing effort, in a statement to the Washington Post. “We will be calling on the labor board to hold Amazon accountable for its illegal and egregious behavior during the campaign.”

https://arstechnica.com/?p=1755663

The National Archives and Records Administration is a federal agency responsible for preserving historically significant federal records, including tweets from senior government officials. For example, former Trump White House spokeswoman Sarah Huckabee Sanders turned over control of her official Twitter account to NARA when she left office. Leaving tweets on Twitter makes them easily accessible by the public.

But Politico reports that Twitter won’t allow anything like this to happen with former President Donald Trump’s now-banned @realDonaldTrump account.

“Given that we permanently suspended @realDonaldTrump, the content from the account will not appear on Twitter as it did previously or as archived administration accounts do currently, regardless of how NARA decides to display the data it has preserved,” a Twitter spokesman told Politico. “Administration accounts that are archived on the service are accounts that were not in violation of the Twitter Rules.”

Twitter permanently banned Donald Trump from its platform two days after the January 6 attack on the US Capitol. Twitter concluded that his tweets on that day had promoted or glorified violence.

Since then, Trump has had to get by without his most powerful megaphone. He no longer has the ability to blast his thoughts directly onto the screens of millions of people every day.

It’s not clear if NARA was seeking to have Twitter reinstate the @realDonaldTrump account under NARA control or create a copy of the account under another name. Perhaps NARA was proposing to post copies of Trump’s tweets to a completely new Twitter account. At this point it doesn’t matter because Twitter has ruled out having Trump’s tweets on its platform in any form.

Instead, NARA says it will post an archive of Trump’s tweet to the website of the Trump Presidential Library, which itself is under NARA’s control. NARA says that the archive will include all of Trump’s tweets, including controversial tweets that got warning labels from Twitter, as well as the tweets that ultimately got Trump banned.

NARA spokesman James Pritchett told Politico that the agency is “working to make the exported content available… as a download.” That sounds like NARA may only offer the tweets as one large download as opposed to making each tweet available online individually—a much less convenient format than bringing the tweets back to Twitter.

It’s not clear how much this matters in practice. There is already at least one private website hosting copies of Trump’s tweets. But there’s no guarantee that independent sites like this will still be around a decade from now, whereas Twitter and NARA (or a successor agency), in all likelihood, will still be here.

I would have expected social media sites like Twitter to care more about not having Trump as an active user than about eradicating every trace of his old writings from their platforms. But Twitter apparently feels strongly about both Trump and his tweets.

And Facebook evidently feels the same way. Last week, the company deleted an interview between Trump and his daughter-in-law Lara Trump, warning that any content posted “in the voice of Donald Trump” wasn’t welcome.

https://arstechnica.com/?p=1755229

The Environmental Protection Agency will be issuing revised fuel economy standards by the end of July, said new EPA Administrator Michael Regan, rewriting Trump-era limits that dictate emissions limits for cars and light trucks through the 2026 model year. The goal with the revised standards, he added, will be to mitigate certain climate impacts.

The new fuel efficiency standards will have to be significantly more stringent than those issued by the Trump-era EPA, which only finalized its rules in March 2020 after a 1.5-year-long process. Those limits call for 1.5 percent annual increases in efficiency through 2026 rather than the 5 percent target under Obama-era rules. Fuel efficiency standards in the US are overseen by both the EPA and the National Highway Traffic Safety Administration, an agency of the Department of Transportation.

“We’re taking a strong look at what the science is urging us to do. We’re looking at where technologies are,” Regan said in an interview with Bloomberg News. “We’re marrying our regulatory policy and what we have the statutory authority to do with where the science directs us and where the markets and technology are.”

While Regan did not mention any specific numbers, he did not rule out emissions limits that would force the phasing out of fossil-fuel vehicles. To achieve that, the number would probably be in the range of 60-70 miles per gallon combined, according to EPA methodology, which is what appears on new cars’ Monroney stickers. Today’s gas-powered cars struggle to crack 40 mpg combined, and hybrids have trouble getting more than 60 mpg combined. The least-efficient electric vehicle, on the other hand, the Porsche Taycan, gets the equivalent of 69 mpg.

Sell some credits

Current limits require the nation’s fleetwide average to be 40.4 mpg by 2026, much less than the Obama-era target of 54.5 mpg. These numbers are regulatory in nature—they don’t reflect what consumers see in real-world driving or what appears on the window sticker. To hit their marks, automakers can sell cars and trucks that pollute significantly more or less than the average. Companies that are underperforming the average can buy credits from companies with an excess. Tesla, for example, has sold credits to then-Fiat Chrysler and GM. (Certain vehicles, including many heavy-duty trucks like the Ford F-250, are exempt from fuel economy standards).

The weakening of standards under Trump was partially the result of lobbying by automakers, who wrote a letter to Trump’s transition team just days after the election calling on the EPA and NHTSA to coordinate emissions limits. The companies claimed that low gas prices and weak demand for electric vehicles made it all but impossible to reach the Obama targets. The Trump administration obliged, reviewing the regulations and producing a tortuous argument in favor of weakening emissions limits. The lower standards, the administration said, would ultimately save lives by letting automakers build cheaper vehicles that would allow consumers to buy new models sooner, which presumably would protect them better in a crash.

Today, though, the picture has changed significantly. Some countries and US states have announced the phase-out of fossil fuel vehicles in 2035 or 2040, depending on the jurisdiction. Automakers are announcing or have introduced dozens of new electric models, and EV sales are growing faster than the overall market.

Regan seems to be leaning heavily into the idea that EVs will give the US a path out of its carbon-intensive transportation sector. “It’s a false option to choose between economic development and prosperity and environmental protection,” he said.

https://arstechnica.com/?p=1755220

Around this time last year, Uber and Lyft saw demand plunge for their flagship ride-hailing services as fear of the coronavirus kept most people at home. By May 2020, Uber’s ride bookings had plunged 80 percent from their level a year earlier.

But now, as people get vaccinated and some states are relaxing public health restrictions, demand for rides is soaring. And Uber and Lyft are struggling to recruit enough drivers to meet their needs.

“It takes forever to get an Uber now,” a man outside Boston’s Fenway Park told the local NBC 10 television station. Another man who had just completed an Uber trip to Fenway said he’d waited 16 minutes for his driver to arrive.

Uber is stepping up recruitment

It’s not surprising that drivers would be in short supply. The risks of catching COVID haven’t gone away, so people are still taking a health risk when they drive passengers. At the same time, the economy is bouncing back, bolstered by the last year’s high saving rates and lavish stimulus spending. Many people who were working as Uber or Lyft drivers in early 2020 have moved on to other jobs.

More fundamentally, recruiting drivers takes time and effort. Uber and Lyft spent billions of dollars building up their pool of drivers in the first place.

Uber says that as a result of driver shortages, drivers can make a lot more money now than they did before the pandemic. One of the best-paying cities is Philadelphia, where Uber says drivers are making an average of $31 per hour. Other high-paying cities include Chicago (almost $29/hour), Miami, and Phoenix (both about $26/hour).

These figures include the time drivers are waiting between rides, but they don’t include expenses, which Uber says average around $4 per hour.

On Wednesday, Uber announced plans to sweeten the pot further by offering drivers incentives worth $250 million.

Some regions face specific challenges

While ride-hailing companies are facing shortages across the country, some regions have been hit especially hard. Boston is one of them. Uber says that Boston-area riders are suffering particularly long wait times because Gov. Charlie Baker has declared a state of emergency that effectively prohibits Uber from using surge pricing. Surge pricing helps to balance supply and demand not only by paying drivers more but also by encouraging riders to wait or take alternative forms of transportation.

Meanwhile, in California, Uber says it’s reconsidering features that let drivers in the Golden State see ride destinations and set their own prices. The changes were adopted early last year as part of Uber’s effort to convince the courts that its drivers were independent contractors rather than employees. But Uber recently told the San Francisco Chronicle that the system wasn’t working well—that drivers were cherry-picking the most lucrative rides and declining the rest. That exacerbates the already poor user experience created by the driver shortage, since it means that customers with less lucrative rides may struggle to match with a driver.

https://arstechnica.com/?p=1755140

Russia has implemented a novel censorship method in an ongoing effort to silence Twitter. Instead of outright blocking the social media site, the country is using previously unseen techniques to slow traffic to a crawl and make the site all but unusable for people inside the country.

Research published Tuesday says that the throttling slows traffic traveling between Twitter and Russia-based end users to a paltry 128kbps. Whereas past Internet censorship techniques used by Russia and other nation-states have relied on outright blocking, slowing traffic passing to and from a widely used Internet service is a relatively new technique that provides benefits for the censoring party.

Easy to implement, hard to circumvent

“Contrary to blocking, where access to the content is blocked, throttling aims to degrade the quality of service, making it nearly impossible for users to distinguish imposed/intentional throttling from nuanced reasons such as high server load or a network congestion,” researchers with Censored Planet, a censorship measurement platform that collects data in more than 200 countries, wrote in a report. “With the prevalence of ‘dual-use’ technologies such as Deep Packet Inspection devices (DPIs), throttling is straightforward for authorities to implement yet hard for users to attribute or circumvent.”

The throttling began on March 10, as documented in tweets here and here from Doug Madory, director of Internet analysis at Internet measurement firm Kentik.

In an attempt to slow traffic destined to or originating from Twitter, Madory found, Russian regulators targeted t.co, the domain used to host all content shared on the site. In the process, all domains that had the string *t.co* in it (for example, Microsoft.com or reddit.com) were throttled, too.

That move led to widespread Internet problems because it rendered affected domains as effectively unusable. The throttling also consumed the memory and CPU resources of affected servers because it required them to maintain connections for much longer than normal.

Roskomnadzor—Russia’s executive body that regulates mass communications in the country—has said last month that it was throttling Twitter for failing to remove content involving child pornography, drugs, and suicide. It went on to say that the slowdown affected the delivery of audio, video, and graphics, but not Twitter itself. Critics of government censorship, however, say Russia is misrepresenting its reasons for curbing Twitter availability. Twitter declined to comment for this post.

Are Tor and VPNs affected? Maybe

Tuesday’s report says that the throttling is carried out by a large fleet of “middleboxes” that Russian ISPs install as close to the customer as possible. This hardware, Censored Planet researcher Leonid Evdokimov told me, is typically a server with a 10Gbps network interface card and custom software. A central Russian authority feeds the boxes instructions for what domains to throttle.

The middleboxes inspect both requests sent by Russian end users as well as responses that Twitter returns. That means that the new technique may have capabilities not found in older Internet censorship regimens, such as filtering of connections using VPNs, Tor, and censorship-circumvention apps. Ars previously wrote about the servers here.

The middleboxes use deep packet inspection to extract information, including the SNI. Short for “server name identification,” the SNI is the domain name of the HTTPS website that is sent in plaintext during a normal Internet transaction. Russian censors use the plaintext for more granular blocking and throttling of websites. Blocking by IP address, by contrast, can have unintended consequences because it often blocks content the censor wants to keep in place.

One countermeasure for circumventing the throttling is the use of ECH, or Encrypted ClientHello. An update for the Transport Layer Security protocol, ECH prevents blocking or throttling by domains so that censors have to resort to IP-level blocking. Anti-censorship activists say this leads to what they call “collateral freedom” because the risk of blocking essential services often leaves the censor unwilling to accept the collateral damage resulting from blunt blocking by IP address.

In all, Tuesday’s report lists seven countermeasures:

• TLS ClientHello segmentation/fragmentation (implemented in GoodbyeDPI and zapret)
• TLS ClientHello inflation with padding extension to make it bigger than 1 packet (1500+ bytes)
• Prepending real packets with a fake, scrambled packet of at least 101 bytes
• Prepending client hello records with other TLS records, such as change cipher spec
• Keeping the connection in idle and waiting for the throttler to drop the state
• Adding a trailing dot to the SNI
• Any encrypted tunnel/proxy/VPN

It’s possible that some of the countermeasures could be enabled by anti-censorship software such as GoodbyeDPI, Psiphon, or Lantern. The limitation, however, is that the countermeasures exploit bugs in Russia’s current throttling implementation. That means the ongoing tug of war between censors and anti-censorship advocates may turn out to be protracted.

https://arstechnica.com/?p=1754972

Auto manufacturers and other companies are hoping that the global chip shortage will end soon, but snarled semiconductor supply chains may not untangle until next year.

The mess began when the pandemic upended the market for semiconductors. As demand for cars plummeted, automakers slashed their orders. But at the same time, demand for chips that power laptops and data centers skyrocketed. That bifurcation shifted the market, and when car and truck sales rebounded, semiconductor manufacturers rushed to meet demand. Soon, though, shortages of key components emerged. The industry is known for planning—and for its long lead times—so it could take a while for the chip market to sort itself out.

“There seems to be a broad consensus that it will stabilize by the end of the year,” Chris Richard, principal in Deloitte’s supply chain and network operations practice, told Ars. “But if I go back to 2008 and the financial crisis, it was a couple years after the rebound started before everything smoothed out again.”

It’s not just manufacturing capacity that’s hard to come by. Shortages of wafers and packaging substrates are compounding the problem. Those have hit the automotive sector especially hard, Richard added. A drought in Taiwan and a fire at a Japanese fab threaten to add to the industry’s woes.

Many of the chips in shortest supply, including those destined for the automotive sector, are made using older processes. These mature nodes are typically well understood, and many fabs run them near the limits of their capacity, meaning there’s not a lot of slack in the system.

In other industries, shortages like this can be solved more easily—customers can simply place orders with other manufacturers to meet temporary spikes in demand. But automakers are unlikely to dial up a new supplier, since it takes about three to six months, sometimes more, to qualify chips from a new factory. And semiconductor manufacturers are unlikely to build new fabs to meet what might prove to be temporary surges in demand. In the end, the best bet for both sides is to push for more production at existing fabs.

“A scramble”

Chip manufacturers have responded by ramping up production on their existing lines where they can, but that’s difficult in fabs that are already running above 90 percent capacity. To free up more production, they’re trying to tweak production rates on existing machines, request early deliveries for tools they’ve already ordered, and squeeze more of those tools into space-constrained factories. “It’s just a big scramble,” Richard said.

For many car companies, chip problems have been made worse by the fact that the companies are often several steps removed from semiconductor manufacturers. Over the years, as cars have incorporated more advanced technologies, automakers have outsourced the production of more and more parts to suppliers. That distant relationship stands in sharp contrast with computer and electronics companies, which often work directly with semiconductor companies. Together, they command about 60 to 70 percent of the chip market, while automotive customers account for less than 10 percent.

The current chip crisis and the trend toward electrification are factors likely to change how car companies interact with semiconductor manufacturers. While today’s fossil fuel-powered vehicles use plenty of chips, electric vehicles promise to use more, especially as advanced driver assistance systems, or ADAS, become more widespread in the coming years. The coincidence of the chip shortage and electrification will change how auto executives view their relationship with semiconductor manufacturers, Richard said. Automakers will likely work much more closely with chip companies in the future, even if the resulting car parts are made by several different suppliers.

Some companies have fared better than others. Toyota, for example, requires suppliers to stockpile two to six months of parts as a buffer against supply chain problems. The company developed the plan in the wake of the Fukushima earthquake in 2011, and it has left the company producing when others have idled some plants.

Other automakers waiting on parts will have to wait a bit more. Making chips is a slow process. Even when manufacturing capacity is in place, it can take up to 26 weeks to produce a chip from the time an order is placed, said Falan Yinug, director of industry statistics and economic policy at the Semiconductor Industry Association. “That’s just the physics of manufacturing chips,” he said. “Good news is coming, but you can’t speed up the process.”

https://arstechnica.com/?p=1754890