Facebook said it has disrupted a hacking operation that used the social media platform to spread iOS and Android malware that spied on Uyghur people from the Xinjiang region of China.

Malware for both mobile OSes had advanced capabilities that could steal just about anything stored on an infected device. The hackers, which researchers have linked to groups working on behalf of the Chinese government, planted the malware on websites frequented by activists, journalists, and dissidents who originally came from Xinjiang and had later moved abroad.

“This activity had the hallmarks of a well-resourced and persistent operation while obfuscating who’s behind it,” Mike Dvilyanski, head of Facebook cyber espionage investigations, and Nathaniel Gleicher, the company’s head of security policy, wrote in a post on Wednesday. “On our platform, this cyber espionage campaign manifested primarily in sending links to malicious websites rather than direct sharing of the malware itself.”

Infecting iPhones for years

The hackers seeded websites with malicious JavaScript that could surreptitiously infect targets’ iPhones with a full-featured malware that Google and security firm Volexity profiled in August 2019 and last April. The hackers exploited a host of iOS vulnerabilities to install the malware, which Volexity called Insomnia. Researchers refer to the hacking group as Earth Empusa, Evil Eye, or PoisonCarp.

Google said that at the time some of the exploits were used, they were zero-days, meaning they were highly valuable because they were unknown to Apple and most other organizations around the world. Those exploits worked against iPhones running iOS versions 10.x, 11.x, and 12.0 and 12.1. Volexity later found exploits that worked against versions 12.3, 12.3.1, and 12.3.2. Taken together, the exploits gave the hackers the ability to infect devices for more than two years. Facebook’s post shows that even after being exposed by researchers, the hackers have remained active.

Insomnia had capabilities to exfiltrate data from a host of iOS apps, including contacts, GPS, and iMessage, as well as third-party offerings from Signal, WhatsApp, Telegram, Gmail, and Hangouts. To keep the hacking concealed and prevent the Insomnia from being discovered, the exploits were delivered only to people who passed certain checks, including IP addresses, OSesd, browser, and country and language settings. Volexity provided the following diagram to illustrate the exploit chain that successfully infected iPhones.

A sprawling network

Evil Eye used fake apps to infect Android phones. Some sites mimicked third-party Android app stores that published software with Uyghur themes. Once installed, the trojanized apps infected devices with one of two malware strains, one known as ActionSpy and the other called PluginPhantom.

Facebook also named two China-based companies it said had developed some of the Android malware. “These China-based firms are likely part of a sprawling network of vendors, with varying degrees of operational security,” Facebook’s Dvilyanski and Gleicher wrote.

Officials with the Chinese government have steadfastly denied that it engages in hacking campaigns like the ones reported by Facebook, Volexity, Google, and other organizations.

Unless you have a connection to Uyghur dissidents, it’s unlikely that you’ve been targeted by the operations identified by Facebook and the other organizations. For people who want to check for signs that their devices have been hacked, Wednesday’s post provides indicators of compromise.

https://arstechnica.com/?p=1752030

Ubiquitous work-chat platform Slack this morning rolled out a new feature, Connect DM, that allows users to send direct messages to people they don’t work with. Hours later, the company is already saying “our bad” and promising an update after users demonstrated almost immediately how easy it is to use Connect DM to abuse or harass others.

Slack first rolled out Slack Connect last year, which allowed for companies to create channels shared between multiple Slack servers to facilitate business operations. Basically, if you work for Widget Film Production Inc. and you are collaborating on a project with Venue Studio Corp., Widget employees and Venue employees can both join a shared Slack channel to discuss location scouting for their upcoming project.

Today, however, Slack added a feature that allows anyone in the world with a paid account to send a direct message request to any other Slack user in the world (even if they do not have a paid account). Ilan Frank, Slack’s VP of product, told tech news site Protocol that Slack is deliberately positioning itself to become the chat platform of choice for the business world. “When someone opens up their phone, if they’re connecting with their friends, they click on Facebook or WhatsApp,” Frank said. “If they’re connecting with someone they work with, regardless of where that person works, they should be clicking on Slack.”

Slack appears to have considered the possibility that some bad actors might use its platform for harassment—but it doesn’t appear to have thought about that potential very hard or for very long. Connect DMs are indeed opt-in, in that you have to accept a request from someone before you can interact with them. There’s a giant loophole there, however: the user making the “invitation” gets to send a message of up to 560 characters to their targeted recipient, and Slack emails the recipient the full body of that message.

I used the Ars Technica Slack server to send a dummy invitation to my personal email address to demonstrate:

As others have noted, recipients who receive abusive, harassing, or threatening messages also cannot easily block a specific sender, because Slack sends the notifications from a generalized master inbox.

Following the widespread Twitter and media attention, Slack this afternoon acknowledged the gaping flaw in its process—the customizable invitation text—and promised to amend it.

“After rolling out Slack Connect DMs this morning, we received valuable feedback from our users about how email invitations to use the feature could potentially be used to send abusive or harassing messages,” the company said in a statement. “We are taking immediate steps to prevent this kind of abuse, beginning today with the removal of the ability to customize a message when a user invites someone to Slack Connect DMs. Slack Connect’s security features and robust administrative controls are a core part of its value both for individual users and their organizations. We made a mistake in this initial roll-out that is inconsistent with our goals for the product and the typical experience of Slack Connect usage. As always, we are grateful to everyone who spoke up, and we are committed to fixing this issue.”

https://arstechnica.com/?p=1751937

Richard Stallman’s return to the Free Software Foundation’s board of directors has drawn condemnation from many people in the free software community. An open letter signed by hundreds of people today called for Stallman to be removed again and for the FSF’s entire board to resign.

The open letter said:

Richard M. Stallman, frequently known as RMS, has been a dangerous force in the free software community for a long time. He has shown himself to be misogynist, ableist, and transphobic, among other serious accusations of impropriety. These sorts of beliefs have no place in the free software, digital rights, and tech communities. With his recent reinstatement to the Board of Directors of the Free Software Foundation, we call for the entire Board of the FSF to step down and for RMS to be removed from all leadership positions.

Letter signers include Neil McGovern, GNOME Foundation executive director and former Debian Project Leader; Deb Nicholson, general manager of the Open Source Initiative; Matthew Garrett, a former member of the FSF board of directors; seven of the eight members of the X.org Foundation board of directors; Elana Hashman of the Debian Technical Committee, Open Source Initiative, and Kubernetes project; Molly de Blanc of the Debian Project and GNOME Foundation; and more than 300 others. That number has been rising quickly today: the open letter contains instructions for signing it.

The letter said all members of the FSF board should be removed because they “have enabled and empowered RMS for years. They demonstrate this again by permitting him to rejoin the FSF Board. It is time for RMS to step back from the free software, tech ethics, digital rights, and tech communities, for he cannot provide the leadership we need.” The letter also called for Stallman to be removed from his position leading the GNU Project.

“We urge those in a position to do so to stop supporting the Free Software Foundation,” they wrote. “Refuse to contribute to projects related to the FSF and RMS. Do not speak at or attend FSF events, or events that welcome RMS and his brand of intolerance. We ask for contributors to free software projects to take a stand against bigotry and hate within their projects. While doing these things, tell these communities and the FSF why.”

Stallman’s resignation

For a lengthy summary of the events that led to Stallman’s resignation in September 2019, see our article published yesterday. Stallman resigned after the leak of emails about Jeffrey Epstein’s sex trafficking of a minor, in which Stallman objected to the use of the word “assaulting” and called it “morally absurd to define ‘rape’ in a way that depends on minor details such as which country it was in or whether the victim was 18 years old or 17.”

The open-letter writers also posted a page that listed various of Stallman’s other, similar statements about age-of-consent laws, and a statement in which Stallman “recommended that, should someone find out they are pregnant and the child tests positive for Down’s syndrome, ‘the right course of action for the woman is to terminate the pregnancy.'” The page also said that “RMS has spent years on a campaign against using people’s correct pronouns. This is poorly disguised transphobia.”

“RMS has a history of mistreating women and making them feel uncomfortable, unsafe, and unwelcome,” the page also said, while linking to a summary of allegations.

“Some of us have our own stories about RMS and our interactions with him, things that are not captured in email threads or on video,” the open letter said. “We hope you will read what has been shared and consider the harm that he has done to our community and others.”

Stallman founded the FSF in 1985 and served as its president until his resignation in 2019. He announced his return to the board, as a member but not president, at the FSF’s LibrePlanet conference this past weekend. “I’m now on the Free Software Foundation board of directors once again,” he said. “Some of you will be happy at this and some might be disappointed, but who knows. In any case, that’s how it is. And I’m not planning to resign a second time.”

Stallman’s announcement apparently came as a surprise to conference organizers. The Free Software Foundation’s official Twitter account posted a tweet today that said, “No LibrePlanet organizers (staff or volunteer), speakers, award winners, exhibitors, or sponsors were made aware of Richard Stallman’s announcement until it was public.”

We contacted the Free Software Foundation about the open letter calling for Stallman’s removal today and will update this article if we get a response. At least for now, Stallman’s name is once again listed on the FSF’s board of directors page.

https://arstechnica.com/?p=1751815

The Federal Communications Commission wants to hear from Internet users about their experiences trying to find good broadband service. The FCC announced yesterday that it is seeking “first-hand accounts on broadband availability and service quality directly from consumers” as part of a new data collection effort. People who live in areas where ISPs either haven’t deployed service or have failed to upgrade old networks may be especially interested in participating.

“Far too many Americans are left behind in access to jobs, education, and healthcare if they do not have access to broadband,” acting FCC Chairwoman Jessica Rosenworcel said. “Collecting data from consumers who are directly affected by the lack of access to broadband will help inform the FCC’s mapping efforts and future decisions about where service is needed.” Rosenworcel shared those sentiments on Twitter as well:

Take note. We’re going straight to consumers. https://t.co/bZzsFo46ap

— Jessica Rosenworcel (@JRosenworcel) March 22, 2021

Anyone who wants to participate can fill out the “Share Your Broadband Experience” form at this webpage. While the FCC is trying to find unserved areas, people with broadband access can also tell the FCC about the quality of their current ISPs. “Your experience with the availability and quality of broadband services at your location will help to inform the FCC’s efforts to close the digital divide,” the FCC said.

If you have a specific problem and want a response from your ISP, you can also file a complaint against the ISP at the consumer complaint center that the FCC has been operating for years.

Inaccurate broadband data

The “Share Your Broadband Experience” form is part of a larger project to improve the FCC maps that are supposed to show where broadband exists and where it doesn’t. The actual maps are not very accurate.

“As the Commission develops the tools needed to enhance the accuracy of its existing broadband maps, this new form provides a way for consumers to share their broadband experiences,” the FCC said. “Stories shared by consumers will help to inform the work of the FCC’s cross-agency Broadband Data Task Force.”

For people who want to keep track of the project’s progress, the FCC set up a webpage that it said “will serve as an informational hub for the Broadband Data Collection program, highlighting milestones and providing updates for consumers, state, local, and Tribal government entities, and other industry stakeholders.”

The FCC’s broadband maps help the commission develop policy and decide which parts of the country should get the most broadband-deployment funding. But the maps have long been inaccurate, largely because the FCC’s Form 477 data-collection program that requires ISPs to report coverage lets an ISP count an entire census block as served even if it can serve just one home in the block.

Long road to geospatial maps

In August 2019, the FCC voted to require that ISPs give the FCC geospatial maps of where they provide service instead of merely reporting which census blocks they offer service in. But then-FCC Chairman Ajit Pai did not finish setting up the new system before leaving office in January 2021. His last act on the matter was to issue rules for the collection of new data.

Throughout his time as chair, Pai used the FCC’s bad data to claim that his deregulatory policies were speeding up deployment, including one instance in which his own staff had already pointed out a huge error that skewed the availability data.

Shortly after Democrats took charge of the FCC, Republicans in Congress criticized the commission for the long implementation time. In a letter to Rosenworcel on March 8, the Republican lawmakers stated, “You can imagine our surprise and disappointment when the FCC recently suggested the new maps would not be ready until 2022.”

“With so many Americans still lacking high-speed broadband, we are concerned that delays in completing these maps could lead to further delays in distributing critical broadband funds,” the Republican lawmakers wrote.

Rosenworcel points out Pai’s failure

A week later, Rosenworcel provided an update on the program status while pointing out that the FCC’s previous leadership did not finish the task it started.

“We have talked about doing this for years and years, but the agency failed to get it done,” Rosenworcel wrote. “Congress even prodded the FCC a year ago to fix this situation with a new law—the Broadband DATA Act—and then late last year provided the funding to implement it.”

Shortly after becoming acting chairwoman, Rosenworcel learned “that we had a lot of work to do and hadn’t yet begun many of the steps required to actually build a collection system,” she wrote. Her blog post described what needs to be done:

So now we need to set up a new method for collecting information to build a comprehensive, user-friendly dataset on broadband availability—one that will consider input from state and local governments, Tribal nations, and consumers, supplementing information we gather from carriers. We must also develop, test, and launch IT systems to collect and verify these data. Then we will create—for the first time—a publicly accessible, data-based nationwide map of locations where broadband is truly available throughout the United States.

On February 23, the Rosenworcel-led FCC awarded a contract to consulting firm Emprata “to support the design of complicated data analysis and systems.” On March 8, the commission issued a request for information to find vendors that can implement the new system.

Once the FCC collects geospatial maps from ISPs, US residents will be given a chance to challenge the accuracy of the submitted data. While Rosenworcel has not set an exact timeline for completing the mapping project, some numbers have been thrown around.

“Senate Commerce Chair Maria Cantwell [(D-Wash.)] said Rosenworcel had in a recent conversation ‘intimated’ that a four-month timeline for maps was possible,” a National Journal article stated last week. But when asked about the “intimated” four-month timeline at a press conference, Rosenworcel reportedly declined to commit to a specific amount of time.

Though Rosenworcel is running the FCC’s operations as acting chair, the commission is deadlocked at two Republicans and two Democrats, including Rosenworcel. President Joe Biden still hasn’t nominated a third Democrat, preventing the FCC from passing orders that Republicans object to.

https://arstechnica.com/?p=1751621

A judge has granted class-action status to a suit against Apple over its controversial, allegedly defective MacBook “butterfly” keyboard design, agreeing that owners of any affected model in seven states qualify for the class.

Beginning in 2018, several MacBook owners in seven states filed suits against Apple, claiming that the company knew the butterfly-style switches were defective. In an order (PDF), made public on Friday, Judge Edward J. Davila of US District Court for the Northern District of California agreed to grant class-action status to the suit. All customers residing in California, New York, Florida, Illinois, New Jersey, Michigan, or Washington state who purchased a 2015-2017 MacBook, a 2016-2019 MacBook Pro, or a 2018-2019 MacBook Air now qualify for the class.

The butterfly-style keyboard design was controversial from the start. Apple designed it to be thinner and provide a shorter return, which would save space inside the computer chassis and make typing faster. Some users hated the feel of it, while others loved it. The larger problem, however, seemed to be not one of preference but rather one of basic function: the thinner keys proved to be more susceptible to failure when used in the actual real world, as even small particles of dust accumulating around the switches could make them stop working, requiring a full replacement of the entire keyboard.

The plaintiffs in the suit allege that Apple’s actions, as well as internal documents from the company, show that Apple knew the design was defective. They argue that the company violated several states’ consumer protection laws when it kept selling the defective products to consumers.

A 2018 report found that MacBooks needed keyboard-related repairs roughly 40 percent more often once Apple introduced the butterfly-style keyboard. Repeat repairs—keyboards needing an expensive second or even third fix—also increased significantly.

In June 2018, Apple acknowledged the butterfly-style switches were causing problems, and the company launched a keyboard service program specifically to address those issues. The program allowed for affected MacBook owners to have their keyboards repaired or replaced at no charge for the next four years, and some customers who had previously paid for those repairs became eligible to request refunds.

By mid-2018, Apple only sold MacBook models with butterfly keyboards. By 2019, however, Apple was already overhauling the keyboards in the MacBook Pro line, and by 2020 the company completely phased out the butterfly keyboard from its entire lineup of laptops.

https://arstechnica.com/?p=1751264

Richard Stallman has returned to the Free Software Foundation’s board of directors 18 months after his resignation over controversial comments about Jeffrey Epstein’s sex-trafficking of a minor and age-of-consent laws.

“I have an announcement to make,” Stallman said at the FSF’s LibrePlanet conference. “I’m now on the Free Software Foundation board of directors once again… Some of you will be happy at this and some might be disappointed, but who knows. In any case, that’s how it is. And I’m not planning to resign a second time.”

Video of Stallman’s announcement is available at It’s FOSS News. Stallman gave a talk at LibrePlanet yesterday on “growing injustices in computing,” including “locked-down operating systems; user-restricting app stores; [and] requiring nonfree client software, including Javascript.”

Stallman founded the FSF in 1985 and served as its president until September 16, 2019, when the foundation announced that Stallman had “resigned as president and from its board of directors.” While Stallman is now re-joining the board, he is not serving as president. Geoffrey Knauth holds that position.

Stallman’s controversial emails

Stallman resigned from the FSF and from his visiting scientist role at MIT after the public release of leaked emails about the late computer scientist Marvin Minsky, who was on the MIT faculty from 1958 until his death in January 2016.

Virginia Roberts Giuffre, a victim of Epstein at age 17, testified in a May 2016 deposition that “she was directed to have sex with Minsky when he visited Epstein’s compound in the US Virgin Islands,” The Verge wrote in 2019 when the deposition was unsealed. (Minsky’s widow, Gloria Rudisch, denied that allegation, telling the New York Post that she and her husband “were always together” when visiting Epstein.)

The leaked comments that led to Stallman’s resignation were made in an MIT CSAIL (Computer Science and Artificial Intelligence Laboratory) email thread about a planned protest against MIT’s involvement with Epstein. Stallman objected to the text of the event announcement, saying that it “does an injustice to Marvin Minsky” by saying that Minsky was “accused of assaulting one of Epstein’s victims.”

“The word ‘assaulting’ presumes that he applied force or violence, in some unspecified way, but the article [published by The Verge] itself did say no such thing. Only that they had sex,” Stallman wrote.

Stallman added that “the most plausible scenario is she presented herself to [Minsky] as entirely willing. Assuming she was being coerced by Epstein, he would have had every reason to conceal that from most of his associates.”

After one person wrote that “Giuffre was 17 at the time; this makes it rape in the Virgin Islands,” Stallman responded, “I think it is morally absurd to define ‘rape’ in a way that depends on minor details such as which country it was in or whether the victim was 18 years old or 17.”

“We know that Giuffre was being coerced into sex—by Epstein,” Stallman also wrote. “She was being harmed. But the details do affect whether, and to what extent, Minsky was responsible for that.”

Stallman changed his mind about “voluntarily pedophilia”

On his own website, shortly before resigning from MIT and the FSF, Stallman pointed out that he never defended Epstein.

“Headlines say that I defended Epstein,” Stallman wrote. “Nothing could be further from the truth. I’ve called him a ‘serial rapist’, and said he deserved to be imprisoned. But many people now believe I defended him—and other inaccurate claims—and feel a real hurt because of what they believe I said. I’m sorry for that hurt. I wish I could have prevented the misunderstanding.”

Stallman, who in 2006 wrote, “I am skeptical of the claim that voluntarily [sic] pedophilia harms children,” also wrote in September 2019 that he had changed his mind about sex between adults and children.

“Many years ago I posted that I could not see anything wrong about sex between an adult and a child, if the child accepted it,” Stallman wrote. “Through personal conversations in recent years, I’ve learned to understand how sex with a child can harm per [sic] psychologically. This changed my mind about the matter: I think adults should not do that. I am grateful for the conversations that enabled me to understand why.”

Two days later, Stallman wrote, “I am resigning effective immediately from my position in CSAIL at MIT. I am doing this due to pressure on MIT and me over a series of misunderstandings and mischaracterizations.” Stallman’s resignation from the FSF was announced the same day. He continued leading the GNU operating system project, which is supported by the FSF, despite calls to resign from that position as well.

https://arstechnica.com/?p=1751252

A jury in the plaintiff-friendly Eastern District of Texas has ordered Apple to pay $308.5 million to a small, privately held company for infringing a patent related to digital rights management. 

An expert for Personalized Media Communications, the plaintiff, estimated that Apple owed $240 million. But after a five-day trial, the jury increased the amount by ordering Apple to pay a running royalty, which bases the award on sales or use of a product. 

The jury found that Apple infringed on one of Personalized Media’s patents when it developed the FairPlay DRM system. That DRM would form the foundation of the iTunes Music Store, which was introduced in April 2003. Initially, the DRM-locked audio files were limited to Mac and iPod users who purchased music through the iTunes Music Store, though usage expanded when Apple rolled the system out to Windows users later that year and again when the company introduced its Apple Music streaming service in 2015. 

Personalized Media had originally filed the lawsuit in 2015, alleging infringement of seven patents. Apple successfully challenged the suit before the Patent Trial and Appeal Board, a legal body of the US Patent and Trademark Office. But last year, a federal appeals court struck down the PTAB ruling, finding that some of Personalized Media’s claims for one of the seven patents were, in fact, patentable. The patent in question was first filed in 1995 but wasn’t granted until 2012, almost a decade after the iTunes Music Store launched.

“Cases like this, brought by companies that don’t make or sell any products, stifle innovation and ultimately harm consumers,” Apple wrote to several outlets in an emailed statement. Apple says it will appeal the new verdict.

Personalized Media is somewhat of an outlier in the patent-holding world given that it claims to only hold and defend patents developed internally. Stereotypical patent trolls file lawsuits to defend patents they hold or acquire from other companies. 

The small company has also filed lawsuits against Netflix, Google, and Akamai. It lost the Google trial late last year.

https://arstechnica.com/?p=1751158

New York City councilmember Ben Kallos says he “watched in horror” last month when city police responded to a hostage situation in the Bronx using Boston Dynamics‘ Digidog, a remotely operated robotic dog equipped with surveillance cameras. Pictures of the Digidog went viral on Twitter, in part due to their uncanny resemblance with world-ending machines in the Netflix sci-fi series Black Mirror.

Now Kallos is proposing what may be the nation’s first law banning police from owning or operating robots armed with weapons.

“I don’t think anyone was anticipating that they’d actually be used by the NYPD right now,” Kallos says. “I have no problem with using a robot to defuse a bomb, but it has to be the right use of a tool and the right type of circumstance.”

Kallos’ bill would not ban unarmed utility robots like the Digidog, only weaponized robots. But robotics experts and ethicists say he has tapped into concerns about the increasing militarization of police: their increasing access to sophisticated robots through private vendors and a controversial military equipment pipeline. Police in Massachusetts and Hawaii are testing the Digidog as well.

“Nonlethal robots could very well morph into lethal ones,” says Patrick Lin, director of the Ethics and Emerging Sciences Group at California Polytechnic University, San Luis Obispo. Lin briefed CIA employees on autonomous weapons during the Obama administration and supports a ban on armed robots. He worries their increased availability poses a serious concern.

“Robots can save police lives, and that’s a good thing,” he says. “But we also need to be careful it doesn’t make a police force more violent.”

In the Bronx incident last month, police used the Digidog to gather intel on the house where two men were holding two others hostage, scoping out hiding places and tight corners. Police ultimately apprehended the suspects, but privacy advocates raised concerns about the technical capabilities of the robot and policies governing its use.

The ACLU questioned why the Digidog was not listed on the police department’s disclosure of surveillance devices under a city law passed last year. The robot was only mentioned in passing in a section on “situational awareness cameras.” The ACLU called that disclosure “highly inadequate,” criticizing the “weak data protection and training sections” regarding Digidog.

In a statement, the NYPD said it “has been using robots since the 1970s to save lives in hostage situations and hazmat incidents. This model of robot is being tested to evaluate its capabilities against other models in use by our Emergency Service Unit and Bomb Squad.”

In a statement, Boston Dynamics CEO Robert Playter said the company’s terms of service prohibit attaching weapons to its robots. “All of our buyers, without exception, must agree that Spot will not be used as a weapon or configured to hold a weapon,” Playter said. “As an industry, we think robots will achieve long-term commercial viability only if people see robots as helpful, beneficial tools without worrying if they’re going to cause harm.”

Local response to the use of the Digidog was mixed, says councilmember Kevin Riley, who represents the Bronx neighborhood where the incident occurred. Some residents opposed police use of the robot and others wanted more human police presence. A third group thought the robots might help prevent police misconduct by creating distance between officers and suspects.

Riley says he’s continuing to speak with residents, who want to feel safe in the neighborhood. “It’s our job as elected officials to educate residents and make sure they have a seat at the table” in discussions, he told WIRED.

The diversity of concerns mirror those in Dallas in 2016. During a standoff with a sniper, local law enforcement used a robot to remotely deliver and detonate an explosive device, killing him. The sniper had shot and killed five police officers.

The incident raised questions about how police acquire robots. Dallas police had at least three bomb robots in 2016. Two were acquired from the defense contractor Northrop Grumman, according to Reuters. The third came through the federal government’s 1033 program, which permits the transfer of surplus military equipment to local police departments. Since 1997, over 8,000 police departments have received over $7 billion in equipment.

A 2016 study from Bard University found that over 280 police agencies in the US had received robots through the 1033 system. One Colorado officer told local press his department acquired as many as a dozen military robots of varying condition, then uses the one that functions best.

President Obama placed limits on the types of equipment that police departments can obtain through the system, but President Trump later reversed them.

The lack of a unified federal response, the increasing number of private vendors furnishing robots, and increasing militarization of the police has made criminal justice and robotics experts wary. They don’t want to wait for a tragedy to consider a ban on weaponized robots.

“The goal for any kind of technology should be harm reduction and de-escalation,” says Peter Asaro, a roboticist and professor at the School of Media Studies at the New School.

“It’s almost always the police officer arguing that they’re defending themselves by using lethal force,” he says. “But a robot has no right to self-defense. So why would it be justified in using lethal force?”

Asaro notes that SWAT teams were created to handle bank robberies and armed riots. Now, they’re overwhelmingly used to serve narcotics warrants, as many as 60,000 times a year nationwide. The rare hostage situation solved by robot intervention, he worries, could justify increasing their use.

Shortly after the Dallas incident, police in Delaware acquired the same type of bomb robot and trained officers in a similar scenario. In 2018, police in Maine used a bomb robot to detonate an explosive and enter the home of a man firing at police from his roof.

“This is happening now,” says Melissa Hamilton, a scholar in Law and Criminal Justice at the University of Surrey in the UK and a former police officer. Hamilton says she’s heard of US police departments running drills similar to the 2016 incident in Dallas, using robots to detonate explosives—not just to neutralize suspects, but to enter buildings or end standoffs.

“I’m concerned that a democracy is turning domestic police into a militarized zone,” she says.

This increasing militarization is part of why Kallos, the New York councilmember, wants to “avoid investing in an ever escalating arms race when these dollars could be better spent” elsewhere.

Lin, the Cal Poly professor, worries that many police officers do not live in the communities they patrol, and remote policing could worsen an “us-versus-them” divide. The Digidog would not be banned under Kallos’ bill, but Lin says military drones offer a cautionary tale. They too began strictly as reconnaissance devices before being weaponized.

“It’s hard to see a reason why this wouldn’t happen with police drones, given the trend toward greater militarization,” Lin says.

This story originally appeared on wired.com.

https://arstechnica.com/?p=1750986

Beginning in April, new iPhones and other iOS devices sold in Russia will include an extra setup step. Alongside questions about language preference and whether to enable Siri, users will see a screen that prompts them to install a list of apps from Russian developers. It’s not just a regional peculiarity. It’s a concession Apple has made to legal pressure from Moscow—one that could have implications far beyond Russia’s borders.

The law in question dates back to 2019, when Russia dictated that all computers, smartphones, smart TVs, and so on sold there must come preloaded with a selection of state-approved apps that includes browsers, messenger platforms, and even antivirus services. Apple has stopped short of that; the suggested apps aren’t preinstalled, and users can opt not to download them. But the company’s decision to bend its rules on preinstalls could inspire other repressive regimes to make similar demands—or even more invasive ones.

“This comes within the context of years and years of mounting regulatory pressure on tech companies” in Russia, says Adrian Shahbaz, director for democracy and technology at the human rights nonprofit Freedom House. The country has undertaken a massive effort to reshape its Internet toward mechanisms for control, censorship, and mass surveillance. And the government has imposed increasingly strict regulations on domestic tech companies. “They must store data on local servers, provide security agencies with decryption keys, and remove content that violates Russian law,” Shahbaz says, though not all companies do all of those things. “And now they’re being forced to promote government-approved apps on their platforms.”

The preinstalled apps law came to be known as the “law against Apple,” because it essentially dared Apple to pull out of the Russian market entirely rather than change the rules in the company’s controlled iPhone ecosystem. Instead, Apple has carved out an exception that others, including Android manufacturers, have not. Google, which develops the open source Android mobile operating system, doesn’t manufacture most of that platform’s hardware directly, and it doesn’t control which apps come preinstalled on third-party devices. (Google does make the Pixel phone but doesn’t sell it in Russia.)

Mikhail Klimarev, executive director of the Internet Protection Society, a Russian nongovernmental organization, says he believes the preinstalled apps law has a dual function for the Kremlin. It creates an opportunity to promote apps that the country can surveil and control, while also allowing the government to manipulate the tech market. The law will penalize and fine any vendor who sells noncompliant computers and smartphones rather than the manufacturers who made them—unless, of course, the company also sells its products directly in Russia, as Apple does.

“The fact is that the responsibility for the violation is imposed not on the vendor, but on the retailer,” Klimarev says. “In this case, the law [will be used] to destroy small sellers. And then the big distributors will raise their prices. In Russia a lot of absurd laws have been adopted lately, which are technically impractical.”

The situation with Russia’s mandatory apps is not the first time Apple has faced invasive legal requirements from an authoritarian government—nor the first time the company has conceded to these demands. Notably, to continue operating in China, Apple agreed to use a domestic cloud provider to store its Chinese customers’ iCloud data and encryption keys. And Apple removes apps from its Chinese iOS App Store when the government demands. The accommodation for Russian apps during setup, though, is a new frontier in Apple’s interactions with repressive governments.

“This is part of a broader trend we’ve seen in countries like Iran, Turkey, and India,” Freedom House’s Shahbaz says. “Authorities are channeling frustration with popular foreign apps while promoting domestic equivalents where data and speech are more tightly controlled by the government. It’s a bait-and-switch.”

From both an economic and national security standpoint, it’s understandable to a degree that governments would want to promote domestic software to their own citizens. But in practice, the Internet’s growing balkanization is eroding Internet freedom worldwide and undermining the entire concept of a decentralized, global web.

Apple’s plan still leaves multiple opportunities for users to remove government-imposed apps, but promoting them during setup will inevitably result in broader distribution of Russia’s chosen software. The apps aren’t specifically developed by the government, but the Kremlin, like many authoritarian governments, has extensive reach within its Internet ecosystem. Broader distribution of its favored apps could result in expanded government access to Russian user data and personal information or even situations where the government tracks which devices are using certain apps and which have removed them.

Questions remain about whether Russia’s end goal is to completely isolate and disconnect its Internet from the wider world or whether the government prefers a hybrid network. But from the Kremlin’s perspective, the opportunity to promote certain apps on iOS is a boon either way.

Apple could have simply allowed Russia to preinstall whatever apps it wanted on iOS devices, but the company also could have taken a radical stand against such interference. Instead, it found a middle ground, one that other countries may well seize on to suit their own autocratic interests.

This story originally appeared on wired.com.

https://arstechnica.com/?p=1750966

Let me bury the lede for a moment to tell you a story. Long ago, in a magical realm called Academe, professors grew wise to the old student tricks of futzing with both margins and text spacing to make their essays fit a prescribed page limit. Triple spacing and two-inch margins could no longer save you from the effects of a debauched evening spent drinking on Franklin Street when you should have been in the library reading “Aurora Leigh” instead.

But for a few shining years, professors didn’t mandate font choices—and they wouldn’t deploy the Red Pen of Shame unless you headlined your takedown of Barthes’ S/Z in, say, Comic Sans.

As someone intent on being a Serious Writer™, I felt it my duty to write papers that would fully showcase my genius. Papers that might, in the strictest sense, exceed the given page count. And when I was really wordsmithing the hell out of my analysis of the court sermons of Lancelot Andrewes, it was always Garamond that came to my rescue.

Ah, Garamond—how you saved me from doing the hard, boring, necessary work of editing! How you squeezed those extra paragraphs back onto page five instead of letting them lie there, bloated and obscene, atop the forbidden page six! How you offered that electric tingle of sophistication as I avoided the plebian, pedestrian, pathetic use of Times New Roman!

Well. Apparently I was not the only one who played this game. My professors got tired of reading papers that were longer than desired. They began mandating (O ye gods!) 12-point Times New Roman, double-spaced, with one-inch margins—or you’d get a big fat zero.

NO YUO

Fast-forward to this week, when the DC Circuit Court of Appeals came to the same realization that lawyers use Garamond to cram more than is strictly allowed into their legal briefs. Federal Rule of Appellate Procedure 32(a)(5) says only that “a proportionally spaced face must include serifs” and must “be 14-point or larger.” But the rules don’t say what proportional fonts can be used in legal filings.

As lawyer John Elwood pointed out on Twitter, “Garamond is more compact than most fonts. For most appellate filings, its use will shave several pages off a brief. For that reason, it’s long been a last resort for page-limited filings.”

As a smaller font, it’s also just harder to read at the same size as fonts like Times New Roman. And the court has had just about enough of it.

“The court has determined that certain typefaces, such as Century and Times New Roman, are more legible than others, particularly Garamond, which appears smaller than the other two typefaces,” the DC Circuit announced this week. The court, it said, wants to “discourage use of Garamond.”

This led to the unusual prospect of legal media running multiple pieces about font choice this week as lawyers argued over the merits of Baskerville and Gill Sans.

The DC Circuit’s animus against Garamond has not yet spread to the broader appellate system. Typeface policies in the Fifth and Third Circuits are, essentially, just the standard Federal Rules of Procedure. But now that judges in an influential appellate circuit have shown their pro-Times New Roman bias, WILL GARAMOND TOO BECOME A VICTIM OF CANCEL CULTURE?

https://arstechnica.com/?p=1750923