Crafting device-maker Cricut has completely abandoned a plan to start requiring all device owners to pay a monthly subscription fee following a week of sustained public blowback.

Cricut makes cutting machines for precise detail work used by millions of home crafters. The machines work much like printers, but in the inverse: you put a pattern into the software, send it to the device, and the machine slices your design into paper, vinyl, fabric, or a hundred other materials. Users who owned the machines have always been able to import as many of their own designs into the software, Design Maker, as they wish.

Last week, however, Cricut announced it was imposing a $7.99 monthly subscription fee for anyone who wished to upload more than a handful of patterns into Design Maker in a given calendar month. The subscription would apply not only to new users, but also to the millions of consumers who already laid out hundreds of dollars for a Cricut device and all its attendant accessories.

Reaction from the crafting community was predictably swift and furious, and earlier this week, Cricut CEO Ashish Arora partially walked back the policy change, saying any Cricut machine purchased before the end of this year—December 31, 2021—would keep unlimited access and be exempt from the subscription fee going forward. Now, however, Arora acknowledges the company has given up entirely.

“My team has spent the week listening, learning, and taking in a lot of feedback. Not every decision we make is perfect, but we take every opportunity to learn and get better,” Arora said in a statement Thursday afternoon. “So we’ve made the decision to reverse our previously shared plans. Right now, every member can upload an unlimited number of images and patterns to Design Space for free, and we have no intention to change this policy. This is true whether you’re a current Cricut member or are thinking about joining the Cricut family before or after December 31, 2021.”

While consumers have emerged victorious in this instance, the win may ultimately be impermanent. Cricut filed last week for an initial public offering of stock, and in the future it may still try to find a way to tap into the everything-as-a-service revenue model zeitgeist employed in an ever-growing variety of sectors. In the meantime, it’s not the first business to have imposed (or tried to impose) a mandatory fee retroactively, and it is unlikely to be the last.

https://arstechnica.com/?p=1750899

The Chinese government is restricting the use of Tesla vehicles at military bases, some state-owned enterprises, and other sensitive facilities, The Wall Street Journal reports. Tesla vehicles have eight cameras outside the vehicle and an internal camera facing the driver.

“The move follows a government security review of Tesla’s vehicles, which Chinese officials said raised concerns because the cars’ cameras can constantly record images, the people said, as well as obtain various data such as when, how and where the cars are being used,” according to the Journal. “The government is concerned that some data could be sent back to the U.S.”

Some Chinese government agencies have been asked not to drive their Teslas to work, according to the Journal. There are also restrictions on driving Teslas into housing compounds for personnel at agencies and companies doing sensitive national security work.

Reuters and Bloomberg have also reported that the Chinese military has restricted Teslas from military facilities due to national security concerns.

In a statement to Chinese media, Tesla insisted that it takes privacy rights seriously and complies with Chinese privacy laws.

Both the US and Chinese governments have taken increasingly strict measures to promote home-grown information technologies and avoid dependencies on the other’s technology stacks. Chinese smartphone makers Huawei and ZTE have faced harsh restrictions by the US government in recent years. The Trump administration made efforts to ban Huawei from the US market altogether. By contrast, China welcomed Tesla’s new car factory in Shanghai.

https://arstechnica.com/?p=1750888

AT&T lied about California’s net neutrality law yesterday when it claimed the law requires AT&T to stop providing “free data” to mobile customers.

In reality, the California law allows AT&T to continue zero-rating HBO Max, its own video service, as long as it exempts all competing video services from data caps without charging the other video providers. But instead of zero-rating all video without collecting payments from its competitors in the online-video business, AT&T decided it would rather not exempt anything at all.

“Unfortunately, under the California law we are now prohibited from providing certain data features to consumers free of charge,” AT&T claimed in its announcement that it is ending the “zero-rating” program that exempts some content from data caps. “Given that the Internet does not recognize state borders, the new law not only ends our ability to offer California customers such free data services but also similarly impacts our customers in states beyond California,” the AT&T announcement also said.

Law allows zero-rating if it’s neutral

Going forward, AT&T will no longer exempt the AT&T-owned HBO Max from its mobile data caps and will stop the “sponsored data” program in which it charges other companies for similar exemptions from AT&T’s data caps. But this is a business decision, not purely a legal one: as we already stated, AT&T could exempt all video streaming services including HBO Max from its mobile data caps without violating the California law as long as AT&T stops charging rival video companies for the same data-cap exemptions.

That’s because California’s net neutrality law allows zero-rating when it’s implemented in a neutral manner. Specifically, the law bans “zero-rating in exchange for consideration, monetary or otherwise, from a third party,” and bans “zero-rating some Internet content, applications, services, or devices in a category of Internet content, applications, services, or devices, but not the entire category.”

The law further states that “[z]ero-rating Internet traffic in application-agnostic ways shall not be a violation… provided that no consideration, monetary or otherwise, is provided by any third party in exchange for the Internet service provider’s decision whether to zero-rate traffic.”

AT&T could choose a category of content, such as streaming video, and exempt everything in that category from its data caps. AT&T wouldn’t be able to charge other video providers for the zero-rating, but providing such a perk to customers could help AT&T earn more revenue by signing up new customers and retaining existing ones who care about the perk. T-Mobile used to do something similar when it zero-rated video and music applications without seeking payments from the video and music providers, albeit with some technical requirements that online services had to meet to qualify for the zero-rating.

AT&T reported $20.1 billion in mobile-division revenue in the last quarter of 2020, and $7.1 billion in EBITDA (Earnings Before Interest, Taxes, Depreciation, and Amortization).

“AT&T’s anti-competitive scheme”

AT&T confirmed to Ars that it has stopped zero-rating HBO Max and that it is ending its sponsored program throughout the US. This decision suggests that AT&T doesn’t like the California law because it prevents preferential treatment of its own video services. AT&T had been zero-rating HBO Max at no extra cost to itself, as any money charged for that arrangement would simply be transferred from AT&T’s WarnerMedia subsidiary to AT&T’s wireless business. Meanwhile, AT&T charges WarnerMedia’s online-video competitors for the same treatment, making them pay to be on a level playing field with HBO Max on AT&T’s wireless network.

“California’s net neutrality law doesn’t ban all zero-rating; it bans anti-competitive forms of zero-rating,” Stanford law professor Barbara van Schewick, who supported California in its court defense of the net neutrality law, told Ars today. “The law does ban AT&T’s anti-competitive scheme where it counts almost everything people do on the Internet, including watching Twitch, Netflix, and their home security cameras, against users’ data caps, but doesn’t count the data from AT&T’s own video services.”

The law “does not ban AT&T from launching a program where it zero-rates all online video or all video chat/conferencing calls—which might be hugely popular in this pandemic. In that case, the California attorney general would retain the right to ensure such programs are actually open to all applications,” van Schewick told us.

AT&T could also use zero-rating in different ways to help customers, van Schewick said. For example, AT&T would be allowed to let customers use unlimited data between 12 am and 6 am “when networks aren’t busy and not count that data against users’ caps,” to help users back up their data and download videos and podcasts, she said.

Instead, AT&T’s approach has been to only zero-rate data for its own services and for online service providers that pay AT&T to zero-rate a specific application.

The California law was enacted in 2018 but only took effect last month after a federal judge denied the broadband industry’s motion for a preliminary injunction. Sen. Scott Wiener (D-San Francisco) introduced the legislation that became California’s net neutrality law. A spokesperson for Wiener told Ars today that Wiener’s office agrees with van Schewick’s interpretation of the law’s provisions on zero-rating.

AT&T didn’t answer key questions

When contacted by Ars today, AT&T declined to explain why it doesn’t zero-rate all video as allowed under California’s net neutrality law.

In an article yesterday, we pointed out another problem with AT&T’s claims about the California law. AT&T said it has to shut off sponsored data in states other than California to comply with the California law, ignoring the fact that AT&T has the ability to shut off sponsored data for individual customers. The proof is that AT&T already lets customers opt out of sponsored data. To comply with a ban on sponsored data in California only, AT&T could shut the feature off for all California-based customers and perhaps use the device-location data AT&T already collects to make sure out-of-state customers don’t get “free data” when they enter California.

“AT&T’s zero-rating plan currently permits users to turn their zero-rating on and off,” California Attorney General Xavier Becerra said in a court brief defending the state law in September 2020. “Thus, contrary to AT&T’s assertions, it already has the capability to switch off zero-rating for users who opt out and can simply use that functionality to disable zero-rating for California users.”

We asked AT&T why it doesn’t disable sponsored data for California-based users only and did not get an answer.

Zero-rating requires a “low data cap”

In a blog post yesterday, van Schewick wrote that “[z]ero-rating only works when you have a low data cap. That creates an incentive for ISPs to keep low data caps and keep unlimited plans expensive.”

Becerra made a similar point in the court brief while arguing that “communities of color and low-income communities” are disproportionately harmed by zero-rating.

“[I]t is indisputable that communities of color and low-income communities need fair access to the open Internet,” Becerra wrote. “But the zero-rated plans to which these communities disproportionately subscribe cannot supply this, because zero-rating allows ISPs to set artificially low data caps for these plans, and leaves these customers with insufficient access for everyday needs.”

The Democratic-led FCC in late 2016 found that AT&T violated net neutrality rules, saying that “the Sponsored Data program strongly favors AT&T’s own video offerings while unreasonably discriminating against unaffiliated edge providers and limiting their ability to offer competing video services to AT&T’s broadband subscribers on a level playing field.”

Republican Ajit Pai quickly rescinded that finding after becoming FCC chairman in early 2017 and later repealed the federal net neutrality rules, paving the way for California to impose its own law.

https://arstechnica.com/?p=1750696

There is a strange sort of symmetry in the world of personal data this week: one new report has identified a company that wants to sell the US government granular car location data from basically every vehicle in the world, while a group of privacy advocates is suing another company for providing customer data to the feds.

A surveillance contractor called Ulysses can “remotely geolocate vehicles in nearly every country except for North Korea and Cuba on a near real-time basis,” Vice Motherboard reports.

Ulysses obtains vehicle telematics data from embedded sensors and communications sensors that can transmit information such as seatbelt status, engine temperature, and current vehicle location back to automakers or other parties.

“Among the thousands of other data points, vehicle location data is transmitted on a constant and near real-time basis while the vehicle is operating,” the company wrote in a sales pitch document obtained by Vice. As roughly 100 million new cars are manufactured worldwide each year that are “increasingly connected to the manufacturer, other vehicles, infrastructure, and their owners, it becomes apparent that telematics will revolutionize intelligence,” the document adds. Ulysses claims it can currently access more than 15 billion vehicle locations around the world every month, and it estimates that by 2025, 100 percent of new cars will be connected and transmitting gigabytes of collectible data per hour.

Vice said the office of Sen. Ron Wyden (D-Ore.), who serves on the Senate Intelligence Committee and often advocates for privacy issues, provided it with the document. “Sen. Wyden is conducting an ongoing investigation into the sale of personal data, particularly via data brokers, to put some sunlight on this shady industry,” Keith Chu, a representative for Wyden’s office, told Vice. “Our office is continuing to perform oversight into where data brokers are acquiring Americans’ information and who they’re selling it to.”

Ulysses does not currently have any contracts with the US government but has worked in the past with US Special Operations Command (SOCOM), Vice reports. That contract, which ran from 2016-2017, involved data SOCOM used “to deepen our understanding on how foreign competitors used economic and financial tools against US interests” in Central and South America and in Africa.

Meanwhile, in California…

If Ulysses does snag a federal contract, it would be joining a long line of other firms that sell personal user data to the government.

The Secret Service, Immigration and Customs Enforcement (ICE), and the IRS all purchase cell phone location data that might otherwise require a warrant to obtain. Customs and Border Patrol (CBP) also buys license plate-reader data. The agencies that purchase data have contracts to access databases maintained by brokers that collect information from a wide variety of sources, then package and sell access to it.

The Washington Post reported last month that ICE also purchased access to a database chock-full of consumer information to track immigrants. The database ICE used, CLEAR, includes more than 400 million phone, water, electricity, and other utility documents the agency would otherwise not have been able to access on its own, according to the Post.

A coalition of privacy advocates in California is now suing Thomson Reuters, which operates CLEAR, alleging that it violates state privacy law by collecting and sharing personal information without individuals’ consent.

“When we look at the ways that these data brokers are remaking our country, the Fourth Amendment concerns are terrifying,” Surveillance Technology Oversight Project Executive Director Albert Fox Cahn, who is participating in the suit, told the Post. “But the way that they’re allowing companies to track millions without the most basic consent is deeply alarming as well.”

Sen. Wyden also told the Post he plans to introduce federal legislation soon to close the loopholes that allow such data sales. “I do think that there’s going to be a new focus on privacy in this session,” Wyden said. “I think as more and more states pass privacy legislation, pressure builds for Congress to finally pass federal legislation.”

https://arstechnica.com/?p=1750420

The broadband industry’s attempt to kill California’s net neutrality law appears to have very little chance of succeeding in the US district court where the case is being heard.

On February 23, the industry’s motion for a preliminary injunction was denied by Judge John Mendez of US District Court for the Eastern District of California, as we reported at the time. We didn’t have much detail on Mendez’s reasoning last month, but we’ve since obtained a not-yet-publicly released transcript of the hearing in which he issued his verbal ruling against the injunction. (He did not issue a written ruling, citing time constraints caused by a shortage of judges in his district.)

Mendez’s denial of the injunction means that California can enforce its net neutrality law while the case continues, leaving open the possibility that Mendez could ultimately side with the broadband industry. But Mendez explained during the hearing why he thinks the industry is unlikely to succeed at trial.

“I don’t find that the plaintiffs have demonstrated a likelihood of success on the merits at this stage of the litigation,” Mendez said.

The California law prohibits Internet service providers from blocking or throttling lawful traffic. It also prohibits requiring fees from websites or online services to deliver or prioritize their traffic to consumers, bans paid data cap exemptions (so-called “zero-rating”), and says that ISPs may not attempt to evade net neutrality protections by slowing down traffic at network interconnection points.

AT&T stops charging for zero-rating

Mendez’s ruling is already having an effect, as AT&T announced Wednesday that it will end its “sponsored data” program in which it charges online services for data cap exemptions.

“We regret the inconvenience to customers caused by California’s new ‘net neutrality’ law,” AT&T said. “Given that the Internet does not recognize state borders, the new law not only ends our ability to offer California customers such free data services but also similarly impacts our customers in states beyond California.”

As Stanford professor Barbara van Schewick pointed out, AT&T’s claim that California’s zero-rating ban forces it to end sponsored data in other states is contradicted by the fact that AT&T lets customers opt out of sponsored data. Since AT&T has already implemented the ability to disable sponsored data for individual customers, it could comply with the California law simply by turning the feature off for all customers in California.

Ernesto Falcon, senior legislative counsel for the Electronic Frontier Foundation, wrote on Twitter that “AT&T’s version of zero rating with low data caps was a way to drive their users to content they owned. It is why low-income advocates in CA wanted it gone. Mobile-only users tended to be low-income and weren’t getting the full Internet.”

AT&T also complained that a “patchwork of state regulations” is “unworkable,” failing to mention that AT&T’s longtime fight against US-wide net neutrality rules helped ensure that states would issue their own laws.

Judge didn’t buy ISPs’ interstate argument

Most of the court hearing transcript consists of the judge asking questions to each side, and he had many more skeptical questions for broadband-industry lawyers than he had for California. His skepticism carried over from the arguments phase of the hearing to the part where he announced and explained his decision.

The industry, represented by lobby groups for the major cable, DSL, fiber, and mobile Internet providers, “have asserted that the Communications Act gave the FCC the exclusive authority to regulate interstate communications, leaving the states only able to regulate purely intrastate communications,” Mendez said. “But the court finds that the provisions of the Act that the plaintiffs rely on do not support the arguments that have been raised.”

For example, Section 152 of the Communications Act “grants the FCC the authority to regulate interstate communications while precluding it from regulating intrastate communications, but this grant of authority to the FCC indicates nothing about the power of the states,” Mendez said. The fact that US communications law “specifically left out certain types of interstate communications from the FCC’s jurisdiction, like information services, indicates to this court that this is not the type of pervasive regulatory system that left no room for state law,” he said.

Under former Chairman Ajit Pai, the FCC reclassified broadband as an information service instead of as a telecommunications service, abandoning the Title II power the FCC has to regulate ISPs as common carriers. Pai’s FCC also claimed that state net neutrality laws must be preempted because they would conflict with a federal policy of non-regulation.

In the California case, the ISPs “argue that the state common carrier regulations of information services would stand as an obstacle to Congress’s decision to immunize these services from such regulation,” Mendez said. But Congress did not clearly state any intention to preclude both state and federal regulation of information services, he said. Mendez then cited a section of Congress’s 1996 update to the Communications Act that says, “This act and the amendments made by this Act shall not be construed to modify, impair or supercede federal, state, or local law unless expressly so provided in such Act or amendment.”

Precedent cited by ISPs not relevant

Mendez also addressed the ISPs’ argument “that the Supreme Court has long held in analogous contexts that where Congress has prohibited federal regulators from imposing specific obligations, the states may not impose such regulation without running afoul of the Supremacy Clause.”

The ISPs’ argument relies primarily on a 1986 ruling in a case involving federal regulation of wholesale natural gas in interstate commerce, Mendez said. But that case, in which the federal law “occupied the field and precluded state regulation… was a straightforward application of field preemption that has no application here,” Mendez said.

Pai’s FCC decided it “lacked authority”

Mendez also criticized the ISPs’ argument that the California law conflicts with “the FCC’s deregulatory policy for broadband Internet access” that was spelled out in Pai’s repeal of net neutrality rules. As Mendez said, the Pai FCC’s “order reinterpreted broadband Internet as an information service covered by Title I of the Communications Act rather than as a telecommunications service covered by Title II and, thereby, placed it outside the FCC’s regulatory ambit.”

Mendez continued:

The upshot is that the [FCC’s net neutrality repeal] order is not an instance of affirmative deregulation but, rather, a decision by the FCC that it lacked authority to regulate in the first place… [A]gency regulations may preempt state law only if the agency has delegated authority over the subject matter. An agency’s failure to regulate a practice it lacks the authority to regulate simply shows that it is respecting the limits of its powers, it’s not exercising delegated authority to decide whether the matter should be free from state regulation as well.

The FCC does have authority to decide whether broadband Internet access is an information service, but Mendez said that “the deregulatory purposes behind that decision do not have preemptive effect.”

This is similar to what a federal appeals court ruled in 2019 when it upheld Pai’s repeal of federal net neutrality rules while blocking a nationwide preemption of state regulation. “[I]n any area where the Commission lacks the authority to regulate, it equally lacks the power to preempt state law,” that ruling said. Despite blocking Pai’s attempt at a nationwide preemption, the 2019 ruling said that individual state laws could be challenged on a case-by-case basis, allowing litigation against California to continue.

After Biden replaced Trump as president, the US Department of Justice dropped its own lawsuit against California, so the ISPs are fighting on without federal support.

Zero-rating ban is not rate regulation

The transcript also shows that Mendez disagreed with the broadband industry over California’s ban on ISPs charging online services for “zero-rating,” the practice in which AT&T and other carriers exempt specific services from counting against data caps. The ISPs argued that the “zero-rating provisions improperly regulate the rates charged,” Mendez said. He refuted that argument, explaining:

The zero-rating provision provides that as with paid prioritization, mobile broadband providers cannot manipulate their subscriber’s Internet access experience to favor paid or affiliated content over other content on the Internet.

But as defendants points out, these provisions do not regulate how much providers can charge their customers because providers can charge the user as much or as little as they like for the service and, thus, there is no conflict with the [Communications] Act.

Preventing harm to Internet users

Having thoroughly disputed the ISPs’ arguments, Mendez said that denying the injunction would not cause irreversible harm to the industry. “Finding that there is no likelihood of success on the merits of the arguments raised, the court similarly finds that there is, then, no irreparable harm [to ISPs],” Mendez said.

California and its supporters filed briefs “describ[ing] in great detail how the regulations are essential for fair access to the Internet,” Mendez said. He continued:

These are not hypothetical concerns. For example, the defendant submitted a declaration by Anthony Bowden, fire chief for Santa Clara County, that describes how Verizon allegedly throttled the fire department’s connection in the midst of their response to the Mendocino Complex Fire.

Defendants also submitted comments from the New York attorney general, who found that large ISPs made the deliberate business decision to let their network connections become congested with traffic and used that congestion as leverage to extract payments from others.

It does appear… that issuing an injunction would negatively impact the State of California more than the ISP companies and over the well-being of the public. It is clearly not, the court finds, in the public interest to issue the injunction and the balance of equities, the court finds, weighs in California’s favor.

As ISPs appeal, judge urges Congress to act

The ISPs’ lobby groups are appealing Mendez’s denial of the injunction to the US Court of Appeals for the Ninth Circuit. The lobby groups would also likely file an appeal if Mendez rules against them after the case is heard in full.

Mendez, who was nominated by President Bush in 2008, said that “there is an elephant in the room. There is clearly a political overtone to this case.” Mendez said his ruling against ISPs “is a legal decision and it should not be viewed through any type of political lens… it’s obvious to all of us that this case raises issues that, quite frankly, might be better resolved by Congress rather than the federal courts.”

https://arstechnica.com/?p=1750370

Update, 5:24 pm EDT: After several days of public blowback, Cricut CEO Ashish Arora announced the company was walking back the retroactive need for existing customers to start subscribing to the platform.

“We will continue to allow an unlimited number of personal image and pattern uploads for members with a Cricut account registered and activated with a cutting machine before December 31, 2021,” Arora wrote in an open letter to consumers. “If a machine is resold or transferred to a new user, the new user must set up their own Cricut account.”

Arora added that the company is exploring “affordable ways for our future users” who register after the end of this year also to upload an unlimited number of patterns.

Original story, 4:36 pm EDT: Yet another company that makes Internet-connected devices is drawing the wrath of customers by demanding a monthly subscription fee long after users have already sunk hundreds of dollars into its products. This time around, the company is Cricut, which just told customers they’ll lose the ability to upload more than a few patterns per month unless they start paying up.

What’s Cricut?

Cricut makes crafting machines that make precise detail work possible for millions of users. It’s like the inverse of a printer: instead of putting your design onto paper, it slices your design into paper, card stock, vinyl, fabric, or other materials. The devices and accessory kits are sold far and wide in specialty craft and fabric stores such as Michaels or Jo-Ann, as well by mainstream retailers such as Walmart, Target, and Amazon. The devices sell at base prices of $179 and up, not counting the costs of required tools, accessories, and refills.

You control the machines by using a program called Design Space on your phone or computer. The principle hasn’t changed since home desktop publishing software hit in the 1990s. You put a pattern in Design Space and the Cricut cuts the pattern into the material you’ve loaded into it. Users can access a vast library of patterns and templates through Design Space; some are free, while others cost anywhere from a few cents to several dollars each.

Owners can also design their own patterns if they feel particularly creative or ambitious, or they can purchase what they’re looking for from other members of the crafting community on platforms such as Etsy. You just upload the custom design to Design Space—which is, again, software you have installed on your own computer, tablet, or phone—and you’re good to go.

Until now, anyway.

What’s happening?

Cricut dropped a major change into a feature update announcement last Friday: Any Cricut device owner who does not subscribe to the Cricut Access cloud platform will be limited to no more than 20 uploads/imports per month to Design Space. (Designs made using elements Cricut sells through Design Space do not count against the limit.) The change applies not only to new users but also to existing owners.

The company can do this because, as it turns out, you don’t actually import a JPEG pattern you’ve created or downloaded into the software on your PC but, instead, into the cloud. The product descriptions on Cricut devices, however, do not make the cloud connection requirement explicit. From Michaels, for example:

Many customers, as you would expect, are furious that they are now being told to pony up a subscription fee of at least $7.99 per month to use a device they already own, particularly as the company also said it plans to file for an initial public offering of stock. A quick glance at Facebook comments and tweets to the company shows an endless litany of users expressing their fury and threatening to switch to competing products.

This sounds depressingly familiar…

As the 21st century has given us a bounty of Internet-connected devices, so too has it given us plentiful opportunities to see businesses change the terms on customers who have already bought a product, leaving users sitting on piles of junk they paid big money for.

Last year, for example, smart home hub Wink gave customers only one week’s warning they would have to start paying a subscription fee or entirely lose access to the hardware they’d already been using for several years.

At least Wink stayed in operation. More commonly, companies shutter the servers powering products from light bulbs to bathroom scales or pet feeders, transforming expensive electronics into useless bricks.

Unfortunately, the user license agreements for all of Cricut’s products include an all-too-common provision allowing the business (its parent company, Provo Crafts) to update the EULA to “reflect changes in business practices” whenever they want. The consumer recourse? Stop using the thing.

Is this kind of thing even legal? Why?

The answer, for now, is unsatisfying: things are only illegal when there are laws addressing them, and this space so far doesn’t really have specific ones. That may change, however.

There are absolutely state and federal laws against unfair and deceptive consumer practices—what most folks think of as “false advertising,” although actual statutes cover territory both more broad and more specific than that. At the national level, the Federal Trade Commission enforces those regulations. At the state level, it generally falls to consumer protection divisions in the offices of states attorneys general. Consumer Reports’ Justin Brookman, who formerly worked for the Federal Trade Commission, speculated on Twitter that an after-the-fact change such as the one made by Cricut may violate laws against unfair and deceptive acts and practices.

That said, connected devices are still pretty new territory in terms of regulation. When the FTC has taken up complaints against a smart device company alleging unfair or deceptive practices, the complaints usually center on issues of consumer data privacy, focusing on times in which users’ personal information was poorly secured or secretly shared. Broadly speaking, as long as a company discloses what it’s doing in its license agreement, privacy policy, and/or terms of service, it can legally do that thing, even if it’s consumer-hostile. (There are some specific and important exceptions.)

The FTC is beginning to look at dark patterns on websites and apps that deceptively push consumers into making certain disadvantageous decisions. Perhaps some kind of “dark subscription” analysis could follow. In the meantime, that leaves consumers where consumers usually end up: seeking redress in civil court.

Three smart hub users last year filed a lawsuit against Wink, seeking class-action status. In the complaint (PDF), they argue that Wink’s addition of the monthly fee comprises a “fraudulent bait-and-switch pricing scheme” in violation of both federal and state laws against misleading or deceptive business practices. Wink’s terms of service, however, include a mandatory binding arbitration clause that precludes customers’ rights to sue. Some courts in recent months have questioned the validity of similar clauses by other companies, but how a judge might rule in any particular case is anyone’s guess.

https://arstechnica.com/?p=1749942

The Boeing B-52 Stratofortress may have a lock on the title for oldest active-duty US military aircraft. But it only has two years on the Air Force’s other senior citizen, an aircraft that will likely keep flying for as long as the B-52: the venerable Boeing 707.

While the Air Force is working on phasing out the KC-135 refueling plane (which was developed alongside the 707 by Boeing in 1956), the 707 lives on in many other guises. There’s the Air Force’s E-3 AWACS and E-8 JSTARS command and control aircraft, as well as the US Navy’s E-6B Mercury strategic command and control aircraft (also known as the “doomsday plane”), all based on the 707 airframe. And as much as the Air Force might want to send its 707-based aircraft off to the boneyard—the majority of those aircraft were delivered before most active service members were even born—the US Congress recently made that goal more difficult to achieve.

The E-8 JSTARS and its associated ground stations have been at the center of the Army and Air Force’s joint surveillance, command, and control capabilities since the mid-1990s, after seeing early action during the 1991 Gulf War. Originally intended to serve as a flying command post with ground radar for tracking enemy armor, JSTARS added more sensors and capabilities over the past two decades as it evolved into an airborne reconnaissance, intelligence, and communications hub for joint operations, as well as linking troops on the ground with commanders and working with drones and other aircraft to find and fight insurgents.

While the 16 JSTARS aircraft in service have been useful in most of America’s 21st-century conflicts, the 707 airframes they are based on are not getting any younger. The last commercial 707 was withdrawn from service in 2019, and maintenance isn’t getting any less expensive. Additionally, the lumbering 707s are particularly tasty and vulnerable targets in combat involving an adversary with any sort of air defense capabilities to speak of.

Instead of replacing JSTARS and the other 707s with a new, purpose-built aircraft, the Air Force wants to replace them with a totally new concept: a battlefield “Internet of Things” called the Advanced Battle Management System, or ABMS. In ABMS, the sensor and command and control tasks of the JSTARS and AWACS aircraft could be replicated by other existing Air Force systems, including satellites, drones, and combat aircraft with ground target-tracking radar and electro-optical sensors, all tied into a larger network. The Air Force recently awarded a $9 million modification of the ABMS contract held by Folsom, California-based Valley Systems to do all the integration work to turn sensors into nodes on the proposed ABMS IoT. But that work isn’t anticipated to be done until 2022, and there are still bigger issues to resolve with the overall network. So ABMS is still years away from being fully operational.

And that’s why the 707 still has miles to fly before it sleeps. In the 2021 Defense authorization bill passed earlier this year, Congress dictated that the Air Force cannot retire JSTARS aircraft until ABMS can replicate the level of capability and coverage provided by all 16 current aircraft. So these upgraded passenger jets, the same type that heralded the start of the Jet Age in the 1950s, are likely to fly for at least another decade.

Listing image by iStock / Getty Images

https://arstechnica.com/?p=1748481

The government of India is planning to introduce legislation banning cryptocurrency, Reuters reports. The law would impose fines on anyone who trades, mines, or even holds cryptocurrency. The government has a comfortable majority in parliament, giving the proposal a good shot at becoming law.

This would make India one of the most cryptocurrency-hostile jurisdictions in the world. China, for example, has imposed a number of restrictions on trading and mining cryptocurrency, but it hasn’t banned ownership of cryptocurrencies outright.

The legal status of cryptocurrency has been a subject of controversy in India over the last few years. In 2018, India’s central bank banned Indian banks from providing financial services to cryptocurrency exchanges, hampering the growth of the nation’s cryptocurrency economy.

Last year, India’s Supreme Court overturned the ban, triggering a surge of Indian interest in cryptocurrencies. One cryptocurrency exchange, Bitbns, told Reuters that user registrations have risen thirtyfold over the last year.

But the high court’s ruling left the door open for legislation on the subject. In January, rumors started to circulate that the government was considering a ban.

According to Reuters, the legislation would give cryptocurrency owners six months to liquidate their positions before the ban went into effect.

Officials seem to be worried that ordinary Indian consumers could make bad cryptocurrency bets and lose their savings as a result. Bitcoin’s price rose above $60,000 for the first time over the weekend—double its value at the start of the year. But there have been periods in the past where bitcoin has lost more than 80 percent of its value in a few months.

https://arstechnica.com/?p=1749805

A woman in eastern Pennsylvania allegedly created a series of deepfake videos in a harassment and bullying campaign meant to intimidate teenage girls in competition with her daughter and get them kicked off a local cheerleading team.

Hilltown Township police earlier this month charged Raffaela Spone with three counts of cyber harassment of a child after she allegedly began harassing the teenagers last July, according to the Bucks County District Attorney Matthew Weintraub.

The girls received voice and text messages saying, “You should kill yourself,” followed by doctored videos taken from images on their social media profiles and altered to make them appear nude, vaping, or drinking. The altered images included captions reading, “toxic traits, revenge, dating boys, and smoking” and “was drinking at the shore, smokes pot, and uses ‘attentionwh0re69’ as a screen name.” The images and videos were also sent to coaches for the team, seemingly in an attempt to have the girls removed from the team.

On review, police found video “to be the work of a program that is or is similar to ‘Deep Fakes,’ where a still image can be mapped onto an existing video and alter the appearance of the person in the video to show the likeness of the victim’s image instead,” according to an affidavit filed in the case. Spone allegedly used several phone numbers to send the messages, but investigators determined all the numbers were obtained through the same wholesaler and executed a warrant on the wholesaler seeking IP address information about the originating calls. That information was linked to Spone’s residence, and after searching Spone’s devices, police determined her phone was “used to download, access, and or manipulate data” on the wholesaler’s app.

Weintraub said Spone faces misdemeanor charges and not higher-level charges because the “nude” images did not actually depict minors in sexual situations (real or simulated). Instead, the images were basically crude digital removals of an existing bikini to create a “Barbie doll-like” effect “with no obvious genitalia.” Had the images actually looked like nudes, Spone would have faced “a much more serious felony offense.”

Fake images, real crimes

In the way of many once-novel technologies, tools for creating deepfake video are rapidly becoming more accessible and more affordable. In 2019, for example, the maker of a program called DeepNude, which used neural networks to make images of clothed women appear to be realistic nudes, was forced to stop distributing the tool following strong public backlash. A few months later, Ars’ own Timothy Lee demonstrated how to turn Facebook CEO Mark Zuckerberg into the galaxy’s most famous android, Lt. Cmdr. Data from Star Trek: The Next Generation using neural networks.

In recent years, as the technology has become more accessible, several states have passed laws specifically addressing use of deepfakes. Virginia in 2019 became the first to adopt a law imposing criminal penalties on distribution of faked, nonconsensual, sexually themed material (i.e., revenge porn). In the same year, Texas banned deepfakes designed to influence an election. California then passed two laws, one to deal with revenge porn and one to deal with election manipulation, and several other states have continued to introduce legislation tackling one or the other.

The federal government, too, is trying to find its way on the issue. The 2020 National Defense Authorization Act (passed in December 2019) included several provisions related to studying the potential national security threat poised by deepfake content. The 2021 version included similar provisions.

https://arstechnica.com/?p=1749616

A US grand jury has indicted the CEO of a Canadian company that sells encrypted phones, alleging that he and an associate violated racketeering and drug laws. On Friday, the federal grand jury “returned an indictment against the Chief Executive Officer and an associate of the Canada-based firm Sky Global on charges that they knowingly and intentionally participated in a criminal enterprise that facilitated the transnational importation and distribution of narcotics through the sale and service of encrypted communications devices,” the Department of Justice said in a press release.

Sky Global CEO Jean-Francois Eap and Thomas Herdman, a former distributor of Sky Global devices, were charged with a conspiracy to violate the Racketeer Influenced and Corrupt Organizations Act (RICO), a law designed to punish organized crime. They were also charged with a conspiracy to distribute illegal drugs and aiding and abetting. The racketeering and drug counts each carry maximum penalties of life in prison, the DOJ said. The US is seeking criminal convictions and forfeiture of “at least $100,000,000” worth of assets.

The indictment is available in this Motherboard article.

“Sky Global’s devices are specifically designed to prevent law enforcement from actively monitoring the communications between members of transnational criminal organizations involved in drug trafficking and money laundering,” the DOJ said. “As part of its services, Sky Global guarantees that messages stored on its devices can and will be remotely deleted by the company if the device is seized by law enforcement or otherwise compromised.”

The company “installs sophisticated encryption software in iPhone, Google Pixel, Blackberry, and Nokia handsets,” allowing users to “communicate with each other in a closed network, and Sky Global routes these communications through encrypted servers located in Canada and France,” the DOJ said.

CEO defends fight against surveillance

Eap intends to fight the charges, he said in a statement posted on Sky Global’s website yesterday:

Sky Global’s technology… was not created to prevent the police from monitoring criminal organizations; it exists to prevent anyone from monitoring and spying on the global community. The indictment against me personally in the United States is an example of the police and the government trying to vilify anyone who takes a stance against unwarranted surveillance. It seems that it is simply not enough that you have not done anything illegal. There is no question that I have been targeted, as Sky Global has been targeted, only because we build tools to protect the fundamental right to privacy. The unfounded allegations of involvement in criminal activity by me and our company are entirely false.

That statement was available on Sky Global’s website earlier today. But the website now has a message saying, “This domain has been seized by the Federal Bureau of Investigation in accordance with a seizure warrant.”

We contacted the Electronic Frontier Foundation today about this case and about the legality of selling encrypted devices. EFF Senior Staff Attorney Andrew Crocker responded, “Providing an encrypted communications platform to the public is not and should not be illegal, regardless of whether users of the platform engage in illegal activity. In this case, the defendant is accused of knowingly aiding criminal enterprises, which is a separate matter.”

US and Canada cooperated

The indictment was made in US District Court for the Southern District of California. While Sky Global is based in Canada, the indictment said the alleged criminal activity occurred “within the Southern District of California and elsewhere.”

“The international operation to seize Sky Global’s infrastructure involved cooperation and efforts by law enforcement authorities in the United States and Canada,” the DOJ said. “In addition, on March 10, 2021, Europol announced that judicial and law enforcement authorities in Belgium, France, and the Netherlands had wiretapped Sky Global’s servers and monitored hundreds of millions of messages by Sky Global’s users. The European investigation resulted in hundreds of arrests, the seizure of thousands of kilograms of cocaine and methamphetamine, hundreds of firearms, and millions of Euros.”

Eap and Hardman are both citizens of Canada and residents of Vancouver. Warrants were issued for their arrests on Friday.

The case is similar to one involving Phantom Secure CEO Vincent Ramos. In October 2018, the DOJ announced a plea deal in which “Ramos admitted that he and his co-conspirators facilitated the distribution of cocaine, heroin, and methamphetamine to locations around the world including in the United States, Australia, Mexico, Canada, Thailand and Europe by supplying narcotics traffickers with Phantom Secure encrypted communications devices designed to thwart law enforcement.” Ramos was sentenced to nine years in prison and ordered to forfeit $80 million.

Sky Global sold 70,000 modified devices

“There are at least 70,000 Sky Global devices in use worldwide, including in the United States,” the indictment on Friday said. Having operated since 2010, Sky Global “generated hundreds of millions of dollars in profit by facilitating the criminal activity of transnational criminal organizations and protecting these organizations from law enforcement.”

Sky Global replaces key components of commercially available phones to prevent surveillance by law enforcement, the indictment said:

Whereas the standard iPhone, Google Pixel, Blackberry, or handset is sold to the public with the capability for voice communication, GPS navigation, camera, Internet access, and the Messenger services, when Sky Global receives the devices, their technical team removes the internal hardware/software responsible for the GPS, camera, Internet, and voice communications. Sky Global then installs sophisticated encryption software and routes the data through encrypted servers located in Canada and France.

Sky Global charged subscription fees of “approximately $1,200-$2,000 USD per six month period,” the indictment said. Sky Global “used digital currencies, including Bitcoin, to facilitate illegal transactions on the website, to protect the membership’s anonymity, and to facilitate the laundering of the membership’s ill-gotten gains,” the indictment also said.

After the Phantom Secure case, “Sky Global instituted an ‘ask nothing/do nothing’ approach toward its clients,” the DOJ said. “This policy allowed for Sky Global to claim plausible deniability from the activities of their clients that they knew or had reason to know participated in illegal activities, including international drug trafficking.”

https://arstechnica.com/?p=1749746