As the US approached the start of the school year in 2020, the guidance it received from the federal government was a mess. The Centers for Disease Control (CDC) issued a series of documents in late July that was a mix of evidence-based risk analysis and full-throated endorsement of having children back in school, with no consideration of risk at all.

Now, with a new administration in charge and promoting evidence-based policymaking, the CDC has revisited its advice on pandemic safety in schools. The result is a set of documents that are far more coherent in their approach to managing risk. Several documents all promote a single approach to keeping schools open, focused on mask use and distancing, and back that up with an analysis of the latest research on the pandemic’s spread in children. And, in introducing them, CDC Director Rochelle Walensky announced, “I can assure you this is free from political meddling.”

Science-focused

In a press conference announcing the release of the new documents, the count of Walensky’s use of the term “science based” probably reached double digits. Backing that up is one of the three documents released by the CDC on Friday, which focuses entirely on the evidence that was used to formulate the new guidelines. The document makes clear that a lot of the information we now have has come from analyses of what happened after schools were reopened in the autumn, both in the US and overseas. This makes it clear that, even if it weren’t for the change in administration, we were due to revisit our thinking about school safety.

One thing that has remained consistent is that school-age children seem to be less severely affected by COVID-19 than adults. As the US approaches half a million people killed by the pandemic, only 203 of the victims have been under the age of 18. Symptoms in general appear to be less severe in younger individuals, and there are some indications that children are more likely to have asymptomatic cases.

That has ensured that children are less likely to be tested, which has made it harder to determine the spread of the virus between children and from children to adults. The CDC notes that there are some indications that spread via children may be less frequent, but the evidence here is much less certain.

The lower incidence of spread among children would tend to indicate that the risk to children in schools is lower. But the CDC also notes that, in cases where safety guidelines aren’t followed, there have been instances where schools have allowed significant spread of SARS-CoV-2. But safety guidelines can make a big difference. “When mitigation strategies—especially mask use and physical distancing—are consistently and correctly used,” the CDC document states, “the risk of transmission in the school environment is decreased.”

The other key piece of data that informs the new guidelines is on the relationship between spread in the community and that in schools. The CDC says that, for every five additional cases per 100,000 in the community, the risk of an outbreak in schools goes up by over 70 percent.

Science into policy

So, how do you convert that information into policy? In the CDC’s case, there are two key features. One is what Walensky called “layered mitigation.” She said that individual policies each provide a degree of protection, and layering each protection on top of the others can do far more than any individual one can on its own. The five layers the CDC is calling for are:

• Mask use. Mandatory under all circumstances, with guidance on how to wear them effectively.
• Distancing. Beyond spacing students in schools, use small class groups that stay together all day, stagger schedules, etc.
• Handwashing and respiratory etiquette. Make sure students know how to keep themselves and others safe.
• Healthy facilities. Improved ventilation, regular disinfection.
• Contact tracing and isolation. Handled in coordination with local health authorities.

The first two of these—mask use and distancing—are considered the most essential components of the strategy and the ones with the clearest evidence of their effectiveness. But all five are considered central to any strategy to reopen schools safely.

As the Biden administration is expected to boost national testing and vaccination plans, the CDC recognizes that both can also play a role in school safety. While vaccine safety in children is only starting to be tested, vaccination of teachers and staff can help improve safety. And regular screening, if available, can identify and isolate people at risk of spreading the virus in schools and, so, limit the pandemic’s spread. But the guidelines appear to be written with the sense that testing and vaccines are a welcome addition, rather than something that can be relied upon in the immediate future.

Community matters

In addition to describing these policies, the CDC also provides some advice on when they’re most needed. As mentioned above, the spread of the virus in the community has a profound effect on the risks posed within schools. These are defined in terms of both the number of positive tests per capita, as well as the frequency of tests that return positive results (called positivity, this acts as a measure of testing capacity).

A low rate of SARS-CoV-2 transmission is defined as fewer than 10 cases per 100,000 people within the last week, with less than 5 percent of tests returning a positive result. Those numbers shift gradually to high transmission, which is defined as over 100 cases per 100,000 people, and a positive test rate of over 10 percent.

At low and moderate transmission, the CDC advises that schools can be open for full in-person education, with some tolerance for lapses in our ability to keep everyone distanced at all times of the day. This includes allowing sports and other extracurricular activities, although these should be curtailed as the risk of transmission shifts to moderate.

When transmission reaches levels termed substantial, extracurricular activities are eliminated unless they can be held outdoors and with distancing. Physical distancing inside schools becomes mandatory at all times, and teaching shifts to hybrid modes with reduced in-person attendance. At high transmission, students over the age of about 12 shift to remote education, since their risks are thought to be more similar to those of adults. The only exceptions are schools where all of the elements of layered mitigation can be adopted with total compliance. Extracurricular activities are virtual only.

The documents make it clear that evaluating spread in the community is an ongoing activity, and school authorities need to be ready to shut their schools down entirely should conditions indicate this is needed.

In conjunction with these documents, the Department of Education has also issued a document that reiterates much of the CDC’s guidance. In addition, it goes into some of the practicalities on how to create pods of students that are kept together all day and how to bus kids to and from schools while maintaining the distancing advised by the CDC.

A “long needed roadmap”

In introducing these documents, CDC Director Walensky emphasized that “the safest way to open schools is to ensure there is as little circulating disease in the community as possible,” and she went on to call keeping schools open a “shared responsibility.” But right now, we’re nowhere close to handling that responsibility. She said that only 5 percent of counties in the US would currently fall into the low community spread category, while about 90 percent of them would fall into the highest.

Walensky also emphasized that the CDC wasn’t mandating anything via these documents; they were meant to act as “a long needed roadmap” to help guide schools through the process of opening (or keeping open) their schools in a way that’s safe.

Overall, the new documents make a welcome change. While some elements of these documents had been developed during the Trump administration, they were consistently undercut by contradictory messages from different agencies, and political signaling that promoted full school opening regardless of risk.

And that last element may end up undercutting even the best-designed school guidelines. In the US, educational policy decisions happen at the state and local level, and many of these governments are run by people who have gone in for the “open regardless of risk” approach, and the disdain for distancing and mask use that have accompanied it. It will be a difficult fight to get them to adopt the CDC’s guidance.

https://arstechnica.com/?p=1742201

For Clay Scroggins, preaching on Zoom was never part of the plan. As lead pastor at Buckhead Church in Atlanta, he was accustomed to services in a 3,000-seat auditorium, with live music and a jumbotron for people in the back. But God’s plan is often mysterious, so when the city of Atlanta forced him to shut the church’s doors last spring, Scroggins faithfully moved his ministry online. “Ultimately, we were really informed by Jesus’ calling for us to love our neighbors,” he says, “and the most loving thing we could do was to continue to meet virtually.”

And continue to meet virtually they have. Sunday sermons are broadcast live and posted to the church’s YouTube channel for congregants to watch anytime. Bible study and small group meetings have moved to Zoom. Buckhead has even managed to replicate spontaneous church lobby “bump-ins” with video chat breakout rooms for some events. Donations, which provide all of the church’s operating income, remain the same, they just come via a digital collection plate. At Buckhead Church, virtual worship is going so well that some parts of it might be here for good. But not every congregation has been so blessed.

For places of worship, Covid-19 has upended traditions and emptied sacred spaces. About 45 percent of Americans attend religious services regularly, most of them in Christian churches, like Buckhead Church. Or they did, until last spring. Then shutdowns and stay-at-home orders sent congregations scrambling to move their services online, similar to schoolsand workplaces. Some, like Buckhead, found themselves well prepared, with the resources and technical savvy to keep attendance and alms steady throughout the year. Other churches found themselves in trouble, struggling to reach worshippers virtually while facing budget cuts, layoffs, and the threat of bankruptcy or even permanent closure. Nearly one year into the pandemic, its effects on religious life, like other aspects of American society, appears unevenly distributed, with large, successful churches continuing to do well and struggling churches falling further behind.

“The digital divide in churches reflects the digital divide in American society more generally,” says Mark Chaves, a theologian at Duke University and director of the National Congregation Study, which has surveyed religious groups in the US since 1998. Churches with less of a digital presence tend to be located in rural areas. Their congregations are more likely to be older, lower-income, and Black. Those demographic groups are also less likely to have access to broadband, and they have been disproportionately affected by the pandemic, both in health and economic outcomes. Those realities have factored into church outcomes too. A survey from LifeWay Research, which focuses on Christian ministries, found that white pastors were the most likely to report offerings that were higher than expected in the past year. Black pastors, by contrast, were most likely to report that the pandemic economy was impacting their churches “very negatively.” Churches often run on tight margins, and those impacts can have long-term effects: LifeWay Research found that a small percentage of churches have had to cut down on outreach, suspend Sunday School or small group programs, or lay off staff members. Black pastors were more likely to say they cut staff pay or deleted a church position.

Chaves says that churches that have been slow to adopt technology usually have fewer resources, so they’re more reluctant to spend on things like a live-streaming setup. But the resistance can also be cultural. “Sometimes there’s a tension with institutions that are based on tradition,” says Walle Mafolasire, founder and CEO at Givelify, a digital tithing startup. “It’s like, what do you mean, ‘tap, tap, give,’ when it’s right there in the Bible that you should bring your gifts to the altar?” The pandemic, he adds, has changed the equation: “Well, right now, I’m on Zoom. Zoom is my altar.”

At the start of 2020, about half of American churches used a digital tithing service like Givelify. Platforms like these uncouple giving from church attendance and allow people to set up recurring donations, which can make it easier for a church to predict its income. The pandemic greatly accelerated the pace of adoption: By April, one-third of churches that weren’t using a digital tithing platform had signed up for one, according to LifeWay Research. Givelify says that it has seen an explosion of new users, and that the gross amount of donations to churches on its service has remained steady in the pandemic (although, in recent months, the number of donors has slightly decreased). The company also found that one-third of faith-based organizations reported an increase in donations during the 2020 pandemic—specifically, ones with more of a digital presence. Churches with YouTube channels, Instagram pages, and prominent websites saw 533 percent more donations than those without.

Technology like this can help churches of all kinds, but it has been a lifeline for some smaller and more rural churches, which have been more vulnerable in the pandemic. The First Baptist Church Reeltown, in rural Notasulga, Alabama, has a bare-bones digital presence—a website and a Facebook page—and operates its ministry in an “antiquated way,” says Sarah Jones, the church’s secretary. Last year, it broadcast sermons more regularly on Facebook Live while it was unsafe for its 200 members to meet in person. The church also happened to sign up for another digital tithing service called Pushpay at the end of 2019—a decision that quickly paid off. Despite several months when no one attended First Baptist Church Reeltown in person, giving to the church remained consistent. “Most churches our size experienced decreased giving and really felt the weight of that,” says Jones. “That was not our story this year.”

Pushpay says churches have seen as much as $500,000 in new giving a year after signing up for the service. “This means that half a million dollars was sitting there latent, but people started giving because they can now do it from their phone,” says Troy Pollock, Pushpay’s chief ambassador. The company sees its payments platform as an entry-level product that can introduce churches to its other technological solutions.

That’s what happened at First Baptist Church Reeltown. Although the church is still mostly run on “paper and pen,” Jones says, it’s now looking into new ways to incorporate technology into its services. Last year the church used Pushpay’s additional features to upload sermon notes and prayer cards for members. For churches with larger congregations and more complex needs, Pushpay also offers a “church management system”—modeled after Salesforce software—that keeps data on parishioners. The service can help churches to gently nudge their members to be more active, from attending services on Sundays to volunteering and teaching Bible study classes.

For the faith sector, the acceleration of new technologies could lead to massive changes. Other industries, like media and retail, have been transformed as they progressively moved online; money, influence, and attention now converge in a small pool of winners, often at the expense of smaller outfits. Some believe churches might experience something similar. “You’re going to have the top 40 preachers that everyone listens to, and the regular everyday preacher is not going to be able to compete,” says William Vanderbloemen, a former pastor and founder of the Vanderbloemen Search Group, an executive search firm for churches. That’s not to say more niche markets couldn’t also emerge. “People will still show up to hear a message from a pastor who knows their specific community on a micro-contextual level. Like, here’s what happened in our zip code this week, and here’s how it relates to how we think of our God.”

Mafolasire, the founder of Givelify, calls this the “Amazon-like way of experiencing faith.” People might still be practicing with their local parish, but they’re also looking around more at other churches, and in many cases giving money to them too. In the past year, about 20 percent of Givelify’s donors have given money to multiple faith-based organizations. To Mafolasire, this suggests that churches that get ahead will be the ones that can magnify their online presence, drawing in new people from the internet. Givelify’s data from this year backs that up too. “For those churches who saw their giving increase,” says Mafolasire, “it was coming from their ability to reach a wider audience.”

Chaves, who runs the National Congregation Study, says it’s too soon to know whether this year will have a lasting impact on worship practices, and what that impact would be. “Church attendance has been declining slowly for decades,” he says. “Will we see a shift if online participation stays ubiquitous? Or will it mean that more people are participating?” Some early research suggests that churchgoers are eager to get back to in-person services and worshipping together with their community. While some smaller congregations are unlikely to continue broadcasting their sermons on Facebook Live, other churches may find value in a hybrid model, where some people come into Sunday services and others watch from their computers.

At Buckhead Church, the Sunday services will continue to be online until the congregation can safely reunite en masse. Pastor Scroggins doesn’t love preaching over Zoom, but it reminds him of a Bible verse—2 John, 1:12. “I have much to write to you, but I do not want to use paper and ink. Instead, I hope to visit you and talk with you face to face, so that our joy may be complete.” For Scroggins, it captures the essence of pandemic preaching. “I think what John is saying is that the most complete form of communication is face to face,” he says. “But that’s not always possible.”

This story originally appeared on wired.com.

https://arstechnica.com/?p=1742105

Google will pay $76 million over three years to 121 French news organizations to comply with a new French law requiring Google to pay when it uses “snippets” from news articles, Reuters reports. The payments range from $1.3 million paid to Le Monde to $13,741 for a local weekly newspaper called La Voix de la Haute Marne.

Reuters notes that “leading national dailies Le Monde, Le Figaro and Liberation and their respective groups negotiated about €3 million ($3.6 million) each per year on top of this, notably by agreeing in November to sell subscriptions through Google.”

French law gave Google few options

These payments are the result of a shotgun marriage brokered by the French government. Until recently, Google insisted that it wouldn’t pay a penny to link to news articles in France or elsewhere. When Spain passed legislation to force Google to pay to link to Spanish News organizations in 2014, Google responded by shutting down Google News in Spain.

But the latest French legislation left Google with little room to maneuver. France’s competition authority warned that delisting French news sites from Google search results, or removing snippets, would be considered an anticompetitive attack on French newspapers. In effect, the law required Google to use snippets from French news sites and to pay for that use. The only question was how much Google would pay.

Google responded by creating a new product called Google News Showcase and licensing French news content for Showcase. Google’s Showcase licensing deals also cover snippet rights, satisfying the French law. But by bundling these together, Google may have hoped to avoid setting the precedent of paying to directly link to news stories.

France could become an international model

But the strategy doesn’t seem like it is working. The Australian government is considering passing a similar law and seems unbowed by Google’s threat to shut down Google’s search engine nationwide. Microsoft, whose Bing search engine is in the single digits in Australia, has taken full advantage of the controversy, announcing that it would gladly comply with the Australian law. This week, Microsoft President Brad Smith even urged US lawmakers to copy the proposal.

France enacted its law to implement an overhaul of copyright law approved by the European Parliament in 2019—the first EU country to do so. Dozens of other European countries are supposed to implement their own version of the rule in the next few years. Hence, Google’s deal with the French news industry could become a template for the rest of Europe.

Meanwhile, not everyone in the French news industry is happy about the Google deal. L’Alliance de la presse d’information generale, the news industry group that negotiated the deal, only represents some French news organizations. At least one group of publishers that wasn’t part of the deal complained that Google was pursuing a divide-and-conquer strategy.

“These opaque agreements don’t ensure the fair treatment of all news publishers, since the calculation formula isn’t made public,” said Spiil, a union representing independent online news organizations. “Google took advantage of our divisions to advance its interests.”

And while $76 million is hardly a trivial amount of money, it’s not going to make a huge difference to the news organizations that get it. For example, the Le Monde Group, which owns Le Monde and a few other publications had 300 million euros ($360 million) in revenue in 2019. That means Le Monde’s $1.3 million annual payment will be about a third of 1 percent of its publisher’s revenue.

https://arstechnica.com/?p=1742112

A former phone company worker has been charged with conspiracy to commit fraud for allegedly using his access to customer account data to take over the phone numbers of 19 customers, including at least one cryptocurrency holder.

Stephen Daniel DeFiore of Brandon, Florida, received about $2,325 between October 20, 2018, and November 9, 2018 in exchange for swapping the targeted customers’ SIM cards with ones belonging to a co-conspirator, prosecutors in New Orleans said earlier this week. For each SIM swap, the co-conspirator sent DeFiore the customer’s phone number, a four-digit PIN, and a SIM card number to which that phone number was to be swapped, prosecutors said.

The charges come eight months after federal prosecutors charged Richard Yuan Li of Hercules, California, with conspiracy to commit fraud for his alleged role in a SIM swap scam that targeted at least twenty people. Li was in possession of an iPhone 8 which the number of at least one of DeFiore’s victims was routed to, prosecutors said.

The alleged victim was a New Orleans-area medical doctor with cryptocurrency accounts at exchanges including Binance, Bittrex, Coinbase, Gemini, Poloniex, ItBit, and Neo Wallet. Li and his co-conspirators then allegedly accessed the physician’s email and cryptocurrency accounts and stole a “significant portion” of the victim’s holdings.

Prosecutors went on to allege that even after the doctor recovered the phone account, Li or one of his co-conspirators called the doctor to say he had viewed images in the doctor’s Gmail account and balances in the doctor’s cryptocurrency accounts. The caller then demanded 100 bitcoins, worth about $640,000 at the time, in exchange for not publishing the photos or stealing the cryptocurrency.

Prosecutors didn’t identify the phone company DeFiore worked for, but this LinkedIn profile lists a Stephen DiFiore who works as a Verizon customer service representative in Brandon, Florida. Verizon representatives didn’t immediately respond to an email seeking comment for this story. Attempts to reach DeFiore weren’t successful.

This week’s charges come as so-called SIM swapping crimes continue to proliferate, motivated in large part by criminals’ attempts to obtain large amounts of cryptocurrency in online accounts. Once a perpetrator obtains control over victims’ phone accounts, the perp typically uses that access to complete account resets for email accounts and from there resets passwords for other accounts.

If convicted, DeFiore faces a maximum of five years in prison and a fine of up to $250,000. Earlier this week, European officials announced the arrests of 10 individuals in connection with a series of SIM-swapping attacks that reaped more than $100 million.https://arstechnica.com/?p=1742072

A DoorDash driver named Jeffrey Fang was returning to his minivan in San Francisco after completing a delivery last week when he noticed a stranger in his car. After a struggle, he told a local news outlet, another person, an accomplice, got behind the wheel and drove away. Fang’s children, 4 and 1, were still buckled inside.

Four hours later, after a frantic search by neighbors and law enforcement, the minivan was found in another San Francisco neighborhood, with the children safe and unhurt inside.

Fang later told The New York Times that it was hard to find and pay for childcare during the peak dinnertime delivery hours, so he would often bring the kids along with him as he worked for DoorDash. “Most of the people in the gig economy, we’re trying to make it,” he said. “We’re doing what we can, but the odds are stacked against us. It’s not easy. Oftentimes, we have to balance between impossible choices.”

Similar horrifying scenes have played out elsewhere. In January, two Washington, DC, children were kidnapped during a carjacking when a parent left the vehicle to make an Uber Eats delivery. They were also found unhurt. Also in DC, a carjacker who had swiped the vehicle of an Uber Eats driver struck the delivery worker plus a woman and two children on a nearby sidewalk as he tried to drive away.

Across the country, local police departments say carjackings are up. So, too, are home deliveries amid the Covid pandemic. DoorDash announced its first quarterly profit, and Instacart, Uber Eats, Grubhub, and Amazon have all reported record business.

Inevitably, some of those carjackings involve delivery drivers, who sometimes leave their cars running while dropping off food or packages. “We’re seeing carjackings and thefts on the rise nationwide,” Danielle McDonald, a law enforcement liaison for Uber, told reporters at a DC press conference this week.

No one collects national data on carjackings; local departments often group carjackings with other auto thefts or violent crimes. Grubhub and Uber say they keep track of crimes targeting drivers, but they declined to share any details. Exact numbers, then, are difficult to come by.

“Targets on our backs”

But the local figures are dispiriting. Minneapolis police reported 405 carjackings in 2020, more than three times the number in 2019. Police in Louisville, Kentucky, said they saw 30 carjackings in July, compared with four in the same month a year earlier. In Washington, DC, last year, carjackings rose 143 percent, according to local law enforcement. Neighboring Montgomery County, Maryland, issued a warning in January about an uptick in carjackings, many involving people who had left their vehicles running while picking up food deliveries. Oakland, California, police say carjackings rose 38 percent in the city last year, and victims included “delivery and ride-share drivers.”

Chicago carjackings rose by 135 percent in 2020, to 1,415. The Chicago Independent Drivers Guild, an advocacy group for ride-hail drivers, says dozens of Chicago ride-hail and delivery workers have been victimized by carjackers in the last few months. “We are driving around with targets on our backs,” Kevin Nelson, an IDG organizer and ride-hail driver, said in a statement.

Delivery workers are particularly vulnerable to carjacking, and especially right now, says Michael Cherbonneau, a professor of criminology and criminal justice at the University of North Florida who studies street crime. “They’re not from the area, they may not be familiar with it, they may leave their car running to go to drop off packages,” he says. The interruption of routines during the pandemic might make delivery drivers more vulnerable too. There may be fewer people on the street. And many people are wearing masks, so drivers are less alert when a masked person approaches them, giving a potential thief the element of surprise.

The pandemic may also contribute to the rise in carjackings in other ways. Like other violent offenders, carjackers tend to be under 25, Cherbonneau says, and it’s possible that teens, out of in-person school, have more unsupervised time to commit crimes. Cherbonneau also notes the possible effect of last summer’s social justice protests after the killing of George Floyd, as some police departments have appeared to respond with work slowdowns.

“Very traumatic”

The effects of carjacking can last for a long time, even when authorities are able to recover the car. “This is a very traumatic event for a lot of victims. Most people consider their car a safe and sacred place, almost an extension of their house,” says Christopher Herrmann, an assistant professor at CUNY John Jay College of Criminal Justice and a former crime analyst supervisor with the New York City Police Department. “With the gig workers, I feel really bad for them because it’s also their workplace.”

Independent contractors working for app-based companies are generally not eligible for traditional worker’s compensation, even if they’re hurt while on the job. Many of the companies, including Uber, Lyft, and DoorDash, offer drivers insurance for injuries or damages sustained while driving passengers or delivering goods, at an additional cost.

In November, California voters passed a ballot measure requiring transportation and delivery companies to provide gig workers with limited accident insurance, up to $1 million. The state’s worker’s compensation laws, by contrast, have no ceiling. “There is compensation for injury,” says Orly Lobel, a professor of employment and labor law at the University of San Diego School of Law, “but it’s not as robust as worker compensation.”

Driver advocates say the smaller—or nonexistent—coverage is another way gig workers are penalized. “Any interruption to their ability to work can have lasting consequences,” the California-based group Gig Workers Rising said in a statement. “Whether that’s a car accident, illness, or a car break-in—any issue, no matter how small, can have devastating impacts on workers when every delivery or ride counts.”

GoFundMe

App-based companies say they’re aware of the risks to the independent contractors who deliver packages or drive passengers. Uber says it has sent emails and in-app messages to drivers about the risks of carjacking. In many cities, an emergency button on its drivers’ app will automatically send information to 911. A spokesperson for Grubhub said the company “stands ready to support law enforcement investigations.” Neither Instacart nor Amazon responded to requests for comment.

In San Francisco, DoorDash CEO Tony Xu responded to last week’s kidnapping and carjacking in a statement, noting that the company has offered financial support to Jeffrey Fang. A public GoFundMe page has raised $146,000 for the family—well over what Fang usually makes from gig work. DoorDash says it regularly communicates safety tips with those performing deliveries for the app, and that the company is always working to find ways to support delivery people in need of help.

This story originally appeared on wired.com.

https://arstechnica.com/?p=1742084

Maryland today became the first state in the nation to impose a tax on digital advertising revenue, overriding an earlier veto from the governor and incurring the wrath of piles of Big Tech businesses that are all but guaranteed to sue.

The bill (PDF) levies a state tax of up to 10 percent on the annual gross revenues of all digital advertising aimed at users inside Maryland state. Proceeds from the new tax are explicitly earmarked to go into an education fund dedicated to improving Maryland public schools.

“Right now, they don’t contribute,” the bill’s primary sponsor, Sen. Bill Ferguson (D) said of the bill. “These platforms that have grown fast, and so enormously, should also have to contribute to the civic infrastructure that helped them become so successful.”

Both chambers in the state’s General Assembly, its Senate and its House of Delegates, approved the bill by wide majorities last year. Maryland Gov. Larry Hogan vetoed the bill in May, but it had sufficiently high support in both chambers of the legislature to pass a veto override, and both houses approved the veto override this week.

What will the new law do?

The Digital Advertising Gross Revenues Tax does exactly what it sounds like: It taxes revenues generated from online advertising. Digital advertising services, as defined in the bill, include basically every kind of Web or app display ad you can think of, including “advertisements in the form of banner advertising, search advertising, interstitial advertising, and other comparable advertising services.”

The bill calls for using a simple fraction to determine how much tax an operator owes to Maryland: revenues derived from digital advertising services in Maryland over revenues derived from digital advertising services inside the United States.

As an example, let’s say that a company managed to display the same ad to all 330 million US residents at the same time and made $1 from each of those impressions. (Ignore for the moment how deeply unrealistic these numbers are.) That would be $330 million total. There are about 6 million people living in Maryland, so about $6 million, or 1.8 percent, of the total revenue from that specific ad would be taxable in Maryland under the new law.

The amount of tax owed depends on the size of the business. Entities with global (not Maryland or US) annual gross revenues of under $100 million are exempted, although any business with Maryland digital advertising revenue greater than $1 million is still required to file. Businesses with global annual gross revenues higher than $100 million, up to $1 billion, owe 2.5 percent. For businesses between $1 billion and $5 billion, it’s 5 percent, then 7.5 percent for businesses with global revenue up to $15 billion, and 10 percent for anything larger than that.

The largest digital advertising firms, which include Google, Facebook, and Amazon, all fall well into that 10 percent category. Facebook, for example, generated more than $27 billion in advertising revenue in just the fourth quarter of 2020; in the whole calendar year, it generated about $84 billion in advertising revenue. Google generated at least $146.9 billion in advertising revenue in the year 2020, not including YouTube advertising. (YouTube ads generated another $19.8 billion.)

Companies will be required to self-report how much revenue they earn from ads on devices that either have Maryland-linked IP addresses or are “known or reasonably suspected” to be used in the state.

Of course businesses hate it

Tech firms large and small hate this bill exactly as much as you would guess they do, and the clock is basically ticking until someone takes legal action to try to block it.

A coalition of small and medium businesses and trade groups launched a coalition last year to lobby against the tax. The group, which bills itself as Marylanders for Tax Fairness, argues that the tax will “place an unnecessary and undue burden on the state’s entrepreneurs and job creators.”

The coalition blasted today’s veto override in a statement, saying, “This tax increase was historically shortsighted, foolish, and harmful to countless small businesses and employees, and Marylanders will remember it that way… We will continue fighting this regressive tax wherever possible, including in a court of law.”

Among the coalition members are not only several Maryland-based businesses and organizations, including several local Chambers of Commerce, but also most of the large tech-related trade groups. All of the usual suspects who represent advertising, Internet, tech, telecom, or media firms are on the list, including the Internet Association, the IAB, the NCTA, and TechNet. Those four groups represent every online firm from Amazon to Zillow and just about any brand you can name in between.

The stakes for all the firms involved may go well beyond Maryland. Other states, including high-population New York, are considering similar advertising revenue bills of their own.

https://arstechnica.com/?p=1741992

Facebook has gone out of its way to help law enforcement officials identify those who participated in the January 6 riot at the US Capitol, the company said in a Thursday conference call with reporters.

“We were appalled by the violence,” said Monika Bickert, Facebook’s vice president of content policy. “We were monitoring the assault in real time and made appropriate referrals to law enforcement to assist their efforts to bring those responsible to account.”

She added that this “includes helping them identify people who posted photos of themselves from the scene, even after the attack was over” and that Facebook is “continuing to share more information with law enforcement in response to valid legal requests.”

Later in the call, a reporter asked Bickert whether the company had done enough to hamper organizing efforts prior to the riot. Bickert argued that Facebook had done a lot on this front.

She said that Facebook has been taking down “militarized social movements” since last summer and deleted calls to bring weapons to the Capitol. Facebook also shut down numerous QAnon groups as well as some content under the slogan “stop the steal.” Bickert said Facebook has removed 3,000 pages and 10,000 groups related to QAnon.

Federal officials are continuing to comb through the vast amount of social media content that was generated on January 6. They’re seeking to identify people who breached the Capitol and tie them to specific criminal acts, like destroying federal property. The federal government has identified more than 200 suspects connected to the riot, a list that will likely grow longer in the coming weeks.

Not only did Facebook refer public social media content to federal officials, it can also turn over the contents of private communications if it receives a legal order to do so. And with so many camera-enabled phones around, many of the people responsible for the carnage are likely to be identified.

While social media posts are an important source of information, officials are also relying on more traditional investigative techniques. In some cases, riot participants have been identified by ex-lovers or estranged family members.

https://arstechnica.com/?p=1741881

The Biden administration has pledged to take immediate action to address a global shortage of semiconductors that has forced the closure of several US car plants.

Jen Psaki, White House press secretary, said the administration was “identifying potential chokepoints in the supply chain” after coming under pressure from lawmakers, semiconductor companies, and car manufacturers over the shortages.

A surge in demand for consumer electronics during the pandemic has led to the shortage of chips, which has been exacerbated in the US by sanctions on SMIC, the Chinese chipmaker.

It has hamstrung carmakers worldwide as chipmakers diverted supplies for customers in consumer electronics, which pay more for semiconductors.

A White House official said the administration was in “active conversation” with car companies, semiconductor groups, and foreign diplomats in an effort to address the issue.

President Joe Biden will sign an executive order demanding “a comprehensive review of supply chains for critical goods” in the coming weeks, Psaki said.

She added, “The review will be focused on identifying the immediate actions we can take, from improving the physical production of those items in the US to working with allies to develop a coordinated response to the weaknesses and bottlenecks that are hurting American workers.”

General Motors and Ford have idled factories in response to the chip shortage. GM plants in Kansas, Canada, and Mexico will halt production of vehicles until mid-March, while Ford said it would run fewer shifts this week at two plants that manufacture its bestselling F-150 pick-up truck.

Both companies forecast substantial hits to their cash flow and earnings this year because of the shortage. GM said the shortfall could cut up to $2 billion off earnings before interest and taxes; Ford said earnings could decrease up to $2.5 billion.

The carmakers said they were working with suppliers to manage the shortage and were attempting to allocate chips to more profitable vehicles where possible.

The impact on the car industry has attracted the attention of US lawmakers. Last week, 15 senators, including Chuck Schumer, the Senate majority leader, urged the White House to take action on the shortage, which they argued threatened the US’s “post-pandemic economic recovery.”

The senators recommended the White House secure funding authorized by Congress last year in the CHIPS Act to boost domestic semiconductor manufacturing.

The crisis facing carmakers has also fueled calls for the reshoring of semiconductor manufacturing to the US on national security grounds.

On Thursday, the chief executives of big companies in the semiconductor industry wrote to Biden to demand that funding for domestic semiconductor manufacturing be included in his infrastructure recovery plan.

The letter, which was signed by the chief executives of Intel, Qualcomm and GlobalFoundries, among others, noted the US’s declining share of global chip manufacturing over the past three decades. Without further support, the letter warned, the country’s “technology leadership is at risk.”

© 2021 The Financial Times Ltd. All rights reserved Not to be redistributed, copied, or modified in any way.

https://arstechnica.com/?p=1741850

James, a Cox cable-Internet customer in Irvine, California, got an unwelcome email on Tuesday from the Internet provider. Cox’s email told James, who pays $80 a month for broadband, that his 30Mbps upload speeds will soon be reduced to 10Mbps.

A Cox spokesperson told Ars that James and similar customers can keep their 30Mbps upload speeds if they upgrade to a newer modem. But that option wasn’t included in the email to customers, which created the impression that the upload-speed cut is mandatory unless they pay for a more expensive Internet plan.

The different messages given to customers and an Ars reporter suggest that Cox is trying to get people to switch to the lower-upload speed plan and is only mentioning the option of keeping the existing plan as a last resort. Based on what we’ve learned, customers who want to keep their current upload speeds and price should talk to a Cox customer-service rep and ask for that option if the rep doesn’t mention it. Customers can keep their existing modems without losing Internet service entirely, but their upload speeds will be cut unless they upgrade to a new modem and choose to keep their existing plan. Cox has about 5.3 million broadband customers in the United States.

James, who preferred to keep his last name unpublished, is not alone in getting the bad news. Cox’s “Ultimate” Internet plan with 300Mbps download and 30Mbps upload speeds was changed to a 500Mbps download, 10Mbps upload package early last year. At first, Cox let customers on the 300Mbps/30Mbps version keep it, without any nudges to change their plans or upgrade their modems. But that changed with the email Cox sent to James and other customers this week.

While the boost from 300Mbps to 500Mbps download speeds is nice, it pales in comparison to a 67 percent cut in upload speeds during a pandemic that has demonstrated the importance of upstream bandwidth to families with people working and taking classes at home. James and his wife both work from home and have two children, including a 3-year-old son now old enough to stream video on an Amazon Fire Kids Edition tablet.

James bought his own modem for $70 in November 2017 to avoid rental fees. According to Cox, James will have to buy a new modem or rent a new one from Cox (with the first 12 months’ rental fees waived) in order to keep the 300Mbps/30Mbps plan.

Cox email leaves key questions unanswered

The Cox email sent to James and other customers said:

We’re making important network upgrades to provide a better Internet experience for all of our customers. To do this, we need to move Ultimate Classic 300 plan customers with older modems to the new Ultimate plan on or after Wednesday, March 3, 2021.

Your bill will not increase as a result of this change to your Internet service plan.

Ultimate has download speeds of up to 500Mbps, 60 percent more than Ultimate Classic 300. Ultimate’s lower upload speeds of up to 10Mbps still support the typical needs of most users like video chatting, gaming, and uploading large files. However, you need to update your current modem to enjoy the full increase in download speeds.

The email went on to say that customers can upgrade to a Cox-certified DOCSIS 3.1 modem or the official Cox Wi-Fi gateway and that customers who want more than 10Mbps uploads should “call to learn more about equipment and our speed plans.” (DOCSIS is the Data Over Cable Service Interface Specification used by the cable industry to provide Internet access over coaxial cables.)

The email did not explain why James can’t simply keep using his existing plan on his existing DOCSIS 3.0 modem, an Arris SB6183 that supports up to 686Mbps download speeds and 131Mbps upload speeds. The email also didn’t explain why upgrading to a better modem would lead to a 67 percent cut in upload speeds from 30Mbps to 10Mbps, when commonsense would suggest a modem upgrade should increase both download and upload speeds.

Cox email spurs confusion and anger

It seemed to James that the only option to keep his current upload speeds was to buy the more expensive “Gigablast” package that includes 940Mbps download speeds and 35Mbps upload speeds. The plan’s regular price is $120 a month, with a $100 promotional rate for the first 12 months. It is the only plan Cox advertises with upload speeds above 10Mbps.

“It looks like I’m either losing my 300/30 plan in favor of a 500/10 plan, or I’ll be paying Cox even more money,” James told Ars, before we did more research into the predicament. “In the middle of a pandemic where video conferences are king, Cox is trying to force folks working from home into their top tier to make a quick buck. My area in Irvine doesn’t have any alternative broadband options, so I’m stuck until 5G to the home makes an appearance or Starlink miraculously works in semi-dense urban environments.”

Other customers who received the same email complained in a Reddit thread yesterday. “Just got that same email. Work will be pissed when my productivity slows to a crawl cause uploads take 3 times as long,” one person wrote.

“Cox is fucking garbage,” another person wrote. “I used to have AT&T fiber 1000/1000 until I moved. Same price now I have 500/10. What bullshit.”

https://arstechnica.com/?p=1741592

Virginia is poised to follow in California’s footsteps any minute now and become the second state in the country to adopt a comprehensive online data protection law for consumers.

If adopted, the Consumer Data Protection Act would apply to entities of a certain size that do business in Virginia or have users based in Virginia. The bill enjoys broad popular support among state lawmakers; it passed 89-9 in the Virginia House and unanimously (39-0) in the state Senate, and Democratic Gov. Ralph Northam is widely expected to sign it into law without issue in the coming days.

In the absence of a general-purpose federal privacy framework, states all over the nation are very slowly stepping in with their own solutions. The Virginia law is somewhat modeled on California’s landmark Consumer Privacy Act, which was signed into law in 2018 and took effect on January 1, 2020. Legislatures in several other states—including Minnesota, New York, North Dakota, Oklahoma, and Washington—have some kind of data privacy bills currently under consideration.

What would the Virginia law do?

The CDPA applies to entities that “control or process” personal information of 100,000 or more Virginia residents in a calendar year or to entities that make 50 percent or more of their gross revenue from the sale of personal data if they hold information about at least 25,000 residents. Basically, the big data brokers and companies with a major online presence would all be covered, but small businesses would not be. Under the law, these entities that determine “the purpose and means of processing personal data” are called “controllers.”

Covered consumers are also defined very explicitly in the bill, meaning specifically individuals acting on their own or in a “household context.” It does not include actions “in a commercial or employment context.” So if you’re using the Internet at home on your own time, you’re covered; if you’re using the Internet at work for work reasons, you’re not.

Provided that an interaction does involve a private consumer, a covered business, and covered personal information, however, then Virginia residents would gain a handful of explicit new rights for how their data is handled, including:

• The right to confirm if a controller has your data and, if so, to see it
• The right to correct inaccuracies in the data the controller has
• The right to have a controller delete personal data provided by or obtained about you
• The right to opt out of having your data used for targeted advertising; having it sold to a third party; or “profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer.”

The law puts in place guidelines for how controllers should collect, handle, and share personal information. For example, it mandates that data collection must be limited to “what is adequate, relevant, and reasonably necessary” for the purpose at hand. Controllers would also be required to conduct assessments of any activities that involve the use of personal data for targeted advertising, for profiling, or for sale. The assessments also have to “identify and weigh the benefits that may flow, directly and indirectly” to all stakeholders, including the consumer and the public, and the attorney general can request access to those assessments.

The bill contains wide carve-outs specific types of data and covered entities that are already regulated under laws such as HIPAA, the Fair Credit Reporting Act, the Gramm-Leach-Bliley Act, and educational privacy law FERPA.

Notably, the Virginia bill does not include any private right of action whatsoever over violations, meaning you can’t sue if your rights are being violated under the law; only the Virginia attorney general’s office can pursue a case.

Even California isn’t quite California

A coalition of consumer advocates, including the Electronic Frontier Foundation, the Electronic Privacy Information Center, and Consumer Reports say that Virginia’s goals are in the right place, but they argue the CDPA doesn’t go far enough to provide meaningful protection.

“We readily acknowledge that there is a lot to like about the bill,” the organizations wrote in a letter (PDF) to the bill’s primary sponsor. “The CDPA would grant important new rights to Virginia citizens that the residents of most states do not currently enjoy.”

But “[b]ecause the CDPA is based on an opt-out model… the deck is already stacked against consumers,” the coalition notes. “Consumers have to contact hundreds, if not thousands, of different companies in order to fully protect their privacy.”

These opt-out measures haven’t exactly worked as intended in California in the past year, either, the coalition notes, pointing to a Consumer Reports study that found the mandatory “do not sell my information” links required by California law are not only hard to find but sometimes just plain don’t work at all. “At least 14% of the time, burdensome or broken [do not sell] processes prevented consumers from exercising their rights under the CCPA,” the study found, and participants in the study were dissatisfied with the opt-out process more than half of the time.

https://arstechnica.com/?p=1741414