Mastercard said on Wednesday that it is planning to support cryptocurrencies natively on its network. If this actually happens, it will be a big deal, helping to further legitimize virtual currencies and dramatically expand the market for their use.

However, Mastercard says that it’s only going to support cryptocurrencies that meet a number of requirements—including stability, privacy, and compliance with money laundering laws. The problem is that few cryptocurrencies meet Mastercard’s criteria. Indeed, it’s not clear if any of them do.

It’s hard to be both decentralized and regulated

Bitcoin, the first cryptocurrency, was designed to disrupt the power of governments and conventional financial institutions. The bitcoin network has a decentralized architecture that puts it beyond the reach of any government. Without government backing, bitcoin’s price is highly volatile. Users have no recourse against funds lost to hacking or fraud. The bitcoin network doesn’t comply with anti-money laundering laws that conventional financial networks must follow—though some bitcoin intermediaries do.

For bitcoin purists, these are points in bitcoin’s favor. They believe that bitcoin’s open architecture and lack of red tape makes it a fertile platform for innovation and a check on the power of governments. But these same characteristics make the network a nightmare for financial institutions that do need to offer consumer protections and comply with money laundering laws.

This exact tension has hobbled Facebook’s ambitious Libra project—which has since been rebranded Diem. In its early months, Libra’s leaders tried to have it both ways. On the one hand, they said that the Libra network would be open and decentralized like bitcoin (though they admitted full decentralization would take a while). On the other hand, they said that the Libra network would fully comply with regulations that govern conventional financial networks.

But the Libra Association was never able to explain how this would work. For example, if Libra is an open network where anyone can participate, then who will enforce know-your-customer rules that require customers to identify themselves before using the network? If no one is in charge of the network, who will block transactions that authorities identify as belonging to terrorists or drug dealers? Libra struggled to answer these questions, and it’s not clear that they can be answered. Creating a decentralized blockchain network that complies with these rules may not even be possible.

Mastercard’s dilemma

Mastercard pulled out of the Libra Association in 2019 as Libra struggled to answer questions like these from regulators. Shortly afterward, Mastercard released its own list of principles for blockchain partnerships.

Mastercard said it was only interested in dealing with cryptocurrencies that “operate in full compliance with all applicable laws and regulations, including those applicable to anti-money laundering.” In a bit of bureaucratic understatement, the company said that “many of today’s 2,600 digital currencies today fail to do this.”

Now Mastercard says that it is planning to begin supporting some cryptocurrencies natively. Some companies already issue payment cards that allow customers to make payments over the Mastercard network using their bitcoin holdings. But currently, these bitcoin payments are converted to dollars—or another conventional currency—before they are transmitted across the Mastercard network. If the recipient wants to receive the payment in bitcoins, they must convert the dollars back to bitcoins, paying an extra fee for the service.

Mastercard says that by the end of the year, customers will be able to do this natively for some cryptocurrencies. The recipient will get the same digital asset the sender sent, without the need to convert to dollars and back.

“People need in a vehicle for spending”

However, it seems unlikely that bitcoin will make the cut, as the digital currency flunks several of Mastercard’s criteria.

For example, bitcoin’s public ledger may not meet Mastercard’s criteria for customer privacy. Mastercard says that “these digital assets must follow local laws and regulations in the regions they are used”—something bitcoin doesn’t do in much of the world. Eligible cryptocurrencies “will need to offer the stability people need in a vehicle for spending, not investment.” Bitcoin is highly volatile and is rarely used for day-to-day transactions.

The same analysis applies to a lot of other leading cryptocurrencies like ether, litecoin, and dogecoin. Their values fluctuate wildly, and they are too decentralized to meaningfully enforce money laundering rules.

The leading stablecoin, called tether, has shown a track record of stable value. But tether doesn’t seem any better on the other criteria. For example, experts have long raised questions about the solvency of the company behind tether.

USDC probably fits the bill, but will anyone care?

So what could Mastercard be thinking? Few cryptocurrencies out there have been specifically designed for this purpose. Perhaps the best known is USDC, which is currently the second most popular dollar-based stablecoin after tether. The company behind USDC, a US company called Circle, has signaled its commitment to regulatory compliance.

The USDC network won’t be fully open like a conventional cryptocurrency network. Rather, Circle will allow a limited number of financial institutions to issue USDC tokens, and these institutions in turn can grant customers access after verifying their identity. This in turn enables the network to enforce anti-money-laundering laws.

So some industry insiders expect USDC to be the first cryptocurrency supported on the Mastercard network. There may not be that many others that fit Mastercard’s criteria. The big question, then, is how many people actually want to make USDC-denominated payments over the Mastercard network. If you want to send someone a dollar over the Mastercard network, you can just send a dollar. Or if you want to send someone a USDC token, you can do that natively on a blockchain network.

Still, the ubiquity of the Mastercard network may make this an appealing option for some people who don’t have access to specialized cryptocurrency exchanges. We’ll have to see what Mastercard actually does and how the market responds.

https://arstechnica.com/?p=1741530

The Florida water treatment facility whose computer system experienced a potentially hazardous computer breach last week used an unsupported version of Windows with no firewall and shared the same TeamViewer password among its employees, government officials have reported.

The computer intrusion happened last Friday in Oldsmar, a Florida city of about 15,000 that’s roughly 15 miles northwest of Tampa. After gaining remote access to a computer that controlled equipment inside the Oldsmar water treatment plant, the unknown intruder increased the amount of sodium hydroxide—a caustic chemical better known as lye—by a factor of 100. The tampering could have caused severe sickness or death had it not been for safeguards the city has in place.

Beware of lax security

According to an advisory from the state of Massachusetts, employees with the Oldsmar facility used a computer running Windows 7 to remotely access plant controls known as a SCADA—short for “supervisory control and data acquisition”—system. What’s more, the computer had no firewall installed and used a password that was shared among employees for remotely logging into city systems with the TeamViewer application

Massachusetts officials wrote:

The unidentified actors accessed the water treatment plant’s SCADA controls via remote access software, TeamViewer, which was installed on one of several computers the water treatment plant personnel used to conduct system status checks and to respond to alarms or any other issues that arose during the water treatment process. All computers used by water plant personnel were connected to the SCADA system and used the 32-bit version of the Windows 7 operating system. Further, all computers shared the same password for remote access and appeared to be connected directly to the Internet without any type of firewall protection installed.

A private industry notification published by the FBI provided a similar assessment. It said:

The cyber actors likely accessed the system by exploiting cyber security weaknesses including poor password security, and an outdated Windows 7 operating system to compromise software used
to remotely manage water treatment. The actor also likely used the desktop sharing software TeamViewer to gain unauthorized access to the system.

Employees in Oldsmar’s water treatment department and city manager’s office didn’t immediately respond to phone messages seeking comment for this post.

Sins and omissions

The revelations illustrate the lack of security rigor found inside many critical infrastructure environments. In January, Microsoft ended support for Windows 7, a move that ended security updates for the operating system. Windows 7 also provides fewer security protections than Windows 10. The lack of a firewall and a password that was the same for each employee are also signs that the department’s security regimen wasn’t as tight as it could have been.

The breach occurred around 1:30pm, when an employee watched the mouse on his city computer moving on its own as an unknown party remotely accessed an interface that controlled the water treatment process. The person on the other end changed the amount of lye added to the water from about 100 parts per million to 11,100 ppm. Lye is used in small amounts to adjust drinking water alkalinity and remove metals and other contaminants. In larger doses, the chemical is a health hazard.

Christopher Krebs, the former head of the Cybersecurity and Infrastructure Security Agency, reportedly told a House of Representatives Homeland Security committee on Wednesday that the breach was “very likely” the work of “a disgruntled employee.”

City officials said residents were never in danger, because the change was quickly detected and reversed. Even if the change hadn’t been reversed, the officials said, treatment plant personnel have redundancies in place to catch dangerous conditions before water is delivered to homes and businesses.

The shared TeamViewer password was reported earlier by the Associated Press.

https://arstechnica.com/?p=1741283

The success of uncrewed electric drones in the last couple of decades has caused some people to wonder if similar construction techniques to those used in drones could be employed to create small electric aircraft to carry people.

Not only are electric motors more reliable than conventional engines, but they’re also light enough that you can put several of them on a single aircraft, offering an extra margin of safety. The ability to use several motors—together with sophisticated software—means greater design flexibility, opening the door to new types of vertical takeoff and landing (VTOL) aircraft that straddle the line between conventional airplane and helicopter.

This technology got overhyped in the late 2010s. Uber, for example, announced in 2017 that it was aiming to launch a VTOL taxi service in Dallas and Dubai in 2020. Instead, Uber sold off its air taxi efforts to startup Joby in December 2020.

But while the VTOL revolution hasn’t happened as quickly as some early boosters hoped, the industry is making progress. The latest sign is an announcement that United Airlines is investing in VTOL startup Archer and has placed a $1 billion order for 200 VTOL aircraft.

Archer is also raising money from Stellantis, the company formed by the recent merger of carmakers Fiat Chrysler and PSA Peugeot. Stellantis will help Archer make the carbon-fiber fuselage for its aircraft. The investments are part of Archer’s plan to become a public company via a merger with a Special Purpose Acquisition Company.

While battery electric aircraft have a number of advantages, the low energy density of batteries (compared with fossil fuels) means that electric vehicles have limited range. Archer’s first aircraft, due out in 2024, is designed for a range of 60 miles (100km) with a maximum speed of 150 miles per hour (240km/h). This obviously isn’t a long enough range to replace conventional commercial airline flights.

Short hops and big hurdles

Archer and others working on this technology envision a new class of intra-urban air service. A United customer might travel a short distance by car to a nearby “vertiport”—perhaps in a suburban parking lot or atop an urban skyscraper. Then the customer might fly 20 or 30 miles to an airport in 15 or 20 minutes—a trip that might otherwise take an hour by car. VTOL aircraft could also rapidly transport passengers between nearby cities—for example, San Francisco to Palo Alto, Dallas to Fort Worth, or Baltimore to Washington, DC.

Of course, it’s theoretically possible to do this by helicopter, and some wealthy people already do. But advocates argue that electric VTOL aircraft have the potential to be safer, quieter, and much cheaper than a helicopter. Archer says that its aircraft will produce “minimal noise,” and that the cost will be comparable to an Uber ride.

Archer’s initial aircraft will require a pilot. But VTOL advocates hope that we’ll eventually have software sophisticated enough to steer the aircraft on its own—simultaneously eliminating the cost of paying the pilot and opening an extra seat for a passenger.

Beyond the technical challenges of designing the new aircraft, the VTOL vision also poses significant regulatory challenges. It takes several years for the FAA to sign off on a new aircraft design. Moreover, getting urban air transportation to work at scale will likely require an overhaul of the air traffic control system. A large number of small airplanes traveling short distances could overwhelm the existing system.

https://arstechnica.com/?p=1741127

Large numbers of US Internet subscribers are using over 1TB a month for the first time as the pandemic continues to boost home-Internet usage, according to research released today by the vendor OpenVault.

“The power user category continue[d] to accelerate [in Q4 2020], with 14.1 percent of weighted average subscribers now consuming over 1TB of data per month, up 94 percent from 2019,” OpenVault’s report said. In Q4 2019, 7.3 percent of US-based subscribers used over 1TB. (The weighted figures include both users with data caps and users with unlimited plans.)

The 14.1 percent figure is also a big jump from Q3 2020, when OpenVault research found that 8.8 percent of broadband subscribers used at least 1TB per month. The 1TB figure is significant because AT&T and other ISPs impose monthly data caps of 1TB or less. Comcast raised its cap to 1.2TB starting in mid-2020, while Cox’s is now up to 1.25TB. People using 1TB on a capped service are at risk of paying overage fees, which generally cost $10 for each additional block of 50GB.

“With an entire year’s worth of data, the [Q4 2020 report] puts the impact of the COVID-19 pandemic on broadband providers into proper context,” OpenVault wrote. “The explosion in data consumption during 2020 has established a new normal of bandwidth usage that is especially visible when compared with pre-pandemic time periods.”

What OpenVault calls “extreme power users”—subscribers using over 2TB per month—accounted for 2.2 percent of US-based Internet customers in Q4 2020. That’s a 120 percent jump over the 1 percent of customers who passed that mark in Q3 2020.

Data caps push usage down

OpenVault is a vendor that sells a data-usage tracking platform to cable, fiber, and wireless ISPs. Its customers include 150 service providers worldwide. The company says its products have been used by Internet providers to impose data caps via “usage-based billing” schemes since 2012, helping those ISPs generate “over $150 million in incremental revenue annually.” While Internet subscribers aren’t happy about those data caps and overage fees, OpenVault’s research on broadband usage may be interesting to both ISPs and users.

As usual, customers with unlimited data plans go through more data than those who are capped. On broadband networks with unlimited data, there are “30 percent more 2TB power users” than on networks that charge data overage fees, the report said. Specifically, 2.5 percent of users on unlimited networks hit the 2TB mark in Q4 2020, compared to 1.9 percent on capped networks.

This statistic, among others, shows that data caps and overage fees prevent broadband subscribers from using as much as they’d like. OpenVault phrases this in a different way, saying that “[m]oving to a UBB [usage-based billing] approach has proven to curtail extreme power users and the network management challenge they create.”

Median usage on unlimited networks was 300.5GB in Q4 2020, compared to 289GB on capped networks. Meanwhile, average usage on unlimited services was 496.6GB, compared to 472.3GB on capped services. Many people got a break from data caps in the early stages of the pandemic, but ISPs that temporarily lifted their caps started putting them back into place in mid-2020.

Data growth seen for all types of subscribers

Usage growth isn’t just from power users, as seen elsewhere in OpenVault’s report. The median monthly usage in Q4 2020 was 293.8GB, up from 190.7GB in Q4 2019 and 229GB in Q3 2020.

“This growth in median usage demonstrates that bandwidth usage growth defined by the pandemic is distributed evenly across most users and not driven by outliers or extreme users,” OpenVault said.

Average usage in Q4 2020 was 482.6GB, up from 344GB in Q4 2019 and 383.8GB in Q3 2020. From 2018 to 2019, Q4 usage grew 27 percent. In 2020, with the pandemic in full swing, the average Q4 usage grew 40 percent year over year, OpenVault said.

The report also detailed the nominal download speeds customers are paying for, finding that 50.6 percent subscribe to 100Mbps to 200Mbps speeds. A further 15.8 percent subscribe to 200 to 400Mbps, 3.7 percent pay for 500 to 900Mbps, and 8.5 percent subscribe to gigabit plans. On the lower end, 9.1 percent pay for 50 to 75Mbps, 6 percent have 20 to 40Mbps plans, 2 percent have 10 to 20Mbps, and 4.4 percent have plans with download speeds under 10Mbps.

Some ISPs “challenged” by upload growth

During the pandemic, we’ve seen cable companies Cox and Mediacom impose harsh limits on uploads. This has coincided with a large increase in people working and taking classes at home and using more upload-heavy applications. The 482.6GB in average usage measured by OpenVault includes about 31GB worth of uploads.

“Average upstream bandwidth usage in December 2020 reached 31GB, representing 63 percent growth over 2019,” OpenVault said. The growth in upstream usage is “particularly noteworthy for network operators who are challenged with managing upstream bandwidth on their network.”

https://arstechnica.com/?p=1741225

Suing technology firms when they mess up is already hard, especially when it’s over privacy violations. Now, Facebook, Google, and the trade groups representing all the big tech firms are asking the Supreme Court to make it even harder for class actions to pursue cases against them.

Facebook, Google, and all the others submitted a filing (PDF) to the Supreme Court this week essentially arguing that if you cannot prove the specific extent to which their screwup injured you, you should not have any grounds to be part of a lawsuit against them.

Class-action suits start with a lead plaintiff—basically a representative of the group who stands in for hundreds or thousands of other individuals in a similar, or theoretically similar—but not necessarily identical—situation. This is particularly key in cases relating to privacy and data, where a small handful of plaintiffs for whom something goes badly wrong may be the reason that hundreds, thousands, or even millions of users then discover that their data is being similarly mishandled.

The tech firms, however, want the court to say that everyone in the class has to be able to prove a similar injury in order to participate—a limitation that would severely curtail lawsuits such as the biometric privacy case Facebook just settled in Illinois from going forward.

The case

The filing comes as a brief to TransUnion v. Ramirez, which the Supreme Court is expected to hear next month.

In 2011, Sergio Ramirez and his wife went out to buy a car. During the transaction, the dealership ran a credit report on both buyers, as is typical. However, the report—from TransUnion—returned that Ramirez’s name matched a terrorist watchlist maintained by the Department of the Treasury’s Office of Foreign Assets Control (OFAC), and the dealership would therefore not sell him a car. (His wife bought the car solo.)

After the incident at the dealership, Ramirez requested a copy of his TransUnion credit report, which did not mention the OFAC warning at all. TransUnion later sent Ramirez a copy of the OFAC notice, but it did not include a mechanism for challenging this incorrect information, which had linked him to two individuals with different middle initials and birth dates.

Ramirez hired a lawyer and got the alert removed from his TransUnion report. Then, in 2012, Ramirez filed a potential class-action suit alleging that TransUnion violated the Fair Credit Reporting Act. The eventual class was determined to have about 8,200 members. The court found in favor of the plaintiffs, determining that each member of the class should receive more than $7,000 in compensation: $984 in statutory damages, and $6350 in punitive damages.

TransUnion appealed, arguing in part that Ramirez’s case was nonrepresentative, as the vast majority of the other class members incurred no specific harm from its behavior. The US Court of Appeals for the 9th Circuit issued an opinion (PDF) in 2020 finding that the original case was valid and upholding the original ruling. The opinion, however, cut the punitive damages awarded per class member roughly in half.

A few months after losing its first appeal, TransUnion then asked the Supreme Court to take the case. In its petition (PDF), TransUnion argued that Article III of the US Constitution or the Federal Rules of Civil Procedure should bar a class from suing unless the members in it can prove they suffered an actual injury.

The Supreme Court agreed to take the case, and oral arguments are scheduled for March 30. Ahead of next month’s hearing, a whole flurry of amicus curiae (friend of the court) briefs have been filed this week in support of one side or the other.

The concerned parties

This is where our familiar tech firm faces come into play. Google, Facebook, eBay, and three different trade groups—the CCIA, the Internet Association, and TechNet, who together represent just about every tech company you’ve ever heard of—all signed on to an amicus brief this week in support of TransUnion.

“Permitting these abusive no-injury class action lawsuits has a particularly negative effect on [big tech firms] due to the broad scale of their operations,” the filing reads. “If any of the millions of individuals” who use Internet platforms in a given day “claims to be injured by a generalized act or practice that allegedly violates a statute that provides a private cause of action and statutory damages, she can, without more, launch and prosecute to a class action on behalf of herself and millions of other ‘similarly situated’ users, without proving that any other member of the class has actually suffered an injury similar to hers—or any risk of injury” at all.

Translated from legalese, Big Tech’s position is that if you can’t prove that their violation of the law actually hurt you personally, you can’t join a class-action suit permitted by that law.

Those cases are already fairly few and far between because there aren’t many state or federal laws that explicitly apply to potentially widespread privacy violations and provide for consumer lawsuits as a venue of relief. Illinois does have one such law on the books, the Biometric Information Privacy Act (BIPA), and as a result, firms that collect or use specific consumer data without clear disclosures and opt-out mechanisms can find themselves in trouble in that state.

Facebook in January reached a settlement over BIPA violation allegations, and a class of 1.5 million Illinois Facebook users will receive about $300 each as a result. Video platform Vimeo is similarly being sued in the Prairie State, as is controversial facial recognition platform Clearview AI.

“Entirely unharmed”

The amicus filing explicitly cites the Illinois settlement as an example of a case that should not exist. “No plaintiff alleged that he or she had suffered any harm from Facebook’s technology,” the firms wrote, adding that Facebook’s tagging feature includes an opt-out mechanism. “But—according to the complaint—Facebook had not sought the particular kind of consent, or provided putative class members with the particular kind of notice, required by BIPA.”

According to the filing’s reasoning here, Facebook should not have been held liable for violating Illinois law, because doing so didn’t actually hurt anyone, as far as it could tell.

“Commonly,” in lawsuits against tech firms, “many if not most members of the putative class are unaware of the defendant’s technical violation and are entirely unharmed,” the firms wrote.

We will find out sometime in May or June if the Supreme Court decides “no harm, no foul” to be a compelling legal argument.

https://arstechnica.com/?p=1740906

Ten people have been arrested in connection with a series of SIM-swapping attacks that reaped more than $100 million by taking over the mobile phone accounts of high-profile individuals, authorities said on Wednesday.

SIM-swapping is a crime that involves replacing a target’s legitimate SIM card with one belonging to the attacker. The attacker then initiates password resets for accounts for email, cryptocurrency holdings, and other important resources. With control over the target’s mobile phone, the attacker responds to text messages the account providers send to complete the password reset.

The account hijacking typically occurs with either the help of a malicious employee who works for the mobile carrier, or with the help of an attacker posing as the rightful account owner and asking for a new card.

Targeting the rich and famous

Authorities in Europe said that the suspects were part of a network that carried out SIM-swapping attacks throughout last year against high-profile individuals, including sports stars, musicians, Internet influencers, and their families.

After taking over the accounts, the attackers allegedly stole victims’ money, cryptocurrency, and personal information, including contacts. The attackers also allegedly hijacked social media accounts and posted content and messages that masqueraded as the victims. Cryptocurrency losses exceeded $100 million, authorities with Europol said.

Eight suspects, ages 18 to 26, were arrested in the UK on Tuesday. The action followed earlier arrests of two other suspects, located in Malta and Belgium. Press releases here and here from Europol and the UK’s National Crime Agency, respectively, didn’t name the suspects or say if any had entered a plea.

Worldwide scourge

“Sim swapping requires significant organisation by a network of cyber criminals, who each commit various types of criminality to achieve the desired outcome,” said Paul Creffield, head of operations in the NCA’s National Cyber Crime Unit. “This network targeted a large number of victims in the US and regularly attacked those they believed would be lucrative targets, such as famous sports stars and musicians.”

SIM-swapping has emerged as a major criminal enterprise over the past few years, fueled in large part by the rise of cryptocurrency accounts that can hold millions of dollars in digital coin. In early 2019, a Massachusetts man pleaded guilty to a SIM-swap attack that netted $5 million in cryptocurrency. Later that year, an AT&T subscriber sued the mobile carrier on allegations its employees helped hackers perform SIM-swap attacks that robbed the plaintiff of $1.8 million worth of cryptocurrency. Last March, European authorities announced the arrests of 12 individuals alleged to have been part of a SIM-swapping ring that stole more than $4 million.

The arrests are the result of a partnership of law enforcement agencies from the NCA, US Secret Service, Homeland Security Investigations, the FBI, and the Santa Clara California District Attorney’s Office. Investigators notified victims when they were targeted, and when possible did so prior to a SIM swap being successful. The victims then had the opportunity to prevent the attack from working.

Europol provided the following advice for avoiding SIM-swapping attacks:

• Use two-factor authenticator apps rather than having an authentication code sent over SMS
• When possible, do not associate a mobile phone number with sensitive online accounts
• Keep device software up to date
• Don’t reply to suspicious emails or engage over the phone with callers who request personal information
• Limit the amount of personal data shared online

Two other precautions include:

• Ensure the security PIN or password for the mobile account is as strong as it can be. Many PINs by default have four digits but can optionally be made longer
• Ask the mobile carrier to put your account on any type of high security setting available. This may be include an option that requires SIM changes to be made in person or to require a dedicated password or PIN.

https://arstechnica.com/?p=1741171

More broadband-industry groups are lining up against SpaceX’s bid to get nearly $900 million in Federal Communications Commission funding. Two groups representing fiber and rural Internet providers yesterday submitted a report to the FCC claiming that Starlink will hit a capacity shortfall in 2028, when the satellite service may be required to hit a major FCC deployment deadline.

The study was commissioned by the Fiber Broadband Association (FBA) and NTCA-The Rural Broadband Association. They are urging the FCC to carefully examine whether SpaceX’s Starlink broadband service should receive money from the Rural Digital Opportunity Fund (RDOF), which recently awarded SpaceX $885.51 million over 10 years to bring Starlink to 642,925 homes and businesses in 35 states. The funding for SpaceX and other ISPs won’t be finalized until the FCC reviews their long-form applications, which were submitted after the reverse auction.

In a filing accompanying the study they commissioned, the FBA and NTCA told the FCC:

The Commission faces a daunting but essential task in ensuring that winning bidders can meet their public interest obligations and not strand these unserved consumers. And, the stakes become greater when a bidder won the rights to serve hundreds of thousands of unserved locations and intends to use technologies and network infrastructure not yet proven in the market—especially when it may not be discerned for years to come whether those technologies will evolve to the point where they can in fact satisfy the bidder’s RDOF commitments.

One such winning bidder is SpaceX… which has not yet deployed its full constellation of satellites and ground stations and has just begun to offer commercial service. The general public and communications engineers alike, including at FBA and NTCA member companies, often marvel at SpaceX’s plans and efforts; yet, those with engineering experience know there is often a large gap between theoretical and actual network performance.

The FCC won’t necessarily accept the groups’ claims. Forecasting a capacity shortfall seven years in advance is tricky, and the groups who commissioned the study have a vested interest in preventing SpaceX from getting funding. Money that isn’t distributed to SpaceX could be given to other ISPs. SpaceX’s haul of $885.51 million is a large chunk of the $9.2 billion awarded to 180 entities nationwide to expand networks to 5.2 million homes and businesses.

We contacted SpaceX today and will update this article if we get a response.

NTCA represents 850 small telcos while the FBA represents a mix of ISPs, municipalities, and vendors that sell equipment and services to ISPs. The FBA and NTCA filing comes days after lobby groups for electric co-ops that provide broadband told the FCC that SpaceX’s low Earth orbit (LEO) satellite technology is experimental and unproven, and it shouldn’t get funding. The electric co-op groups also raised concerns about fixed-wireless services that are slated to receive FCC funding.

Predicting a capacity crunch

If its funding gets final approval, SpaceX will have to provide 100Mbps download and 20Mbps upload speeds to 642,925 locations to meet its commitment to the FCC. The FBA and NTCA hired consulting firm Cartesian to analyze whether SpaceX can get it done. Conducting the analysis is “no small task given that: (a) SpaceX has provided limited information publicly about its network and the performance capabilities; (b) SpaceX’s network plans and performance capabilities continue to shift; and (c) actions by the Commission in pending and future proceedings may cause SpaceX’s plans to change further,” the groups said.

The results are “based upon the best information publicly available and conservative assumptions with respect to factors such as demand,” but the FBA and NTCA acknowledged that “information furnished confidentially by SpaceX through the long-form process may provide additional inputs and yield different results.” With those caveats, Cartesian’s report predicts that in 2028, 56 percent of subscribers in SpaceX’s FCC-funded areas would “experience service degradation” due to congestion. Cartesian chose 2028 because that’s when a six-year deadline to deploy all required broadband is likely to pass.

“More locations will be impacted if RDOF usage is higher, or SpaceX launches fewer satellites by 2028,” the report continued. “RDOF service could be significantly worse if Starlink capacity is allocated to non-RDOF use cases.” Cartesian said its “model assumes Starlink is able to meet its goal of 12,000 satellites before the mandated RDOF completion date” and that the “throughput capacity of a single satellite is set at 20Gbps per previous SpaceX public statements.”

To predict the capacity required per subscriber, Cartesian said it drew from “current estimates of average bandwidth usage per subscriber, during peak hours, range from 1.7 to 2.7Mbps.” It raised those estimates of peak-hours usage “to establish a minimum capacity required of 3.6Mbps per subscriber to provide 25 percent headroom at highest peak usage.”

Cartesian further tried to account for future growth in bandwidth demand from sources such as 4K streaming video. By 2028, Cartesian estimated that SpaceX will need to provide 15.3 to 20.8Mbps per subscriber to meet its obligations. This is lower than the 100Mbps required download speeds because scenarios in which every broadband subscriber uses every available bit are not realistic. Not all subscribers actively use the Internet during peak hours, either. Cartesian said that previous FCC “testing requirements have imposed an 80/80 threshold, meaning 80 percent of testing locations must equal or exceed speed tests of 80Mbps.”

“We modeled Starlink’s best possible share of subscribers fully served under the low case and high case capacity requirements of 15.3 and 20.8Mbps respectively—customers receiving less will experience service degradation,” the report said. At 15.3Mbps in 2028, 56 percent of subscribers would be under the threshold; at 20.8Mbps in 2028, 57 percent of subscribers would be under the threshold, the report said.

“The median capacity allocation is 14.7-17.1Mbps, and 25-29 percent of subscribers [would] receive less than 10Mbps during peak times,” Cartesian wrote.

Fiber is better—but not available to many

The FCC will examine SpaceX’s technical claims before approving the money, but Starlink may in fact be the best option for numerous Americans who live in broadband deserts. Fiber-to-the-home is obviously today’s gold standard for broadband, providing the fastest speeds, uploads that are as fast as downloads, and excellent reliability. But incumbent ISPs haven’t extended fiber-to-the-home to huge portions of the United States, especially in rural America and even in many urban and suburban areas.

If Starlink can handle the 5 million users that SpaceX is planning for in the US, it could be a huge upgrade in cities and towns where wireline ISPs failed to upgrade old DSL networks. (Customers who at least have cable-broadband access aren’t as likely to need something like Starlink, though cable does lag far behind fiber on upload speeds.)

While SpaceX hasn’t responded to the FBA/NTCA study, the company touted Starlink’s progress last week in a petition to the FCC seeking designation as an Eligible Telecommunications Carrier, saying that “Starlink’s performance is not theoretical or experimental.” The Starlink beta already serving 10,000 users in the US and abroad demonstrates “technical maturity and inherent capacity to support high-throughput, low-latency broadband service to unserved or underserved communities in even the most remote and rural areas of the United States,” the filing said.

“Starlink continues to improve as SpaceX deploys additional infrastructure and capability, averaging two Starlink launches per month, to add significant on-orbit capacity alongside activation of additional gateways to improve performance and expand service coverage areas across the country,” SpaceX said.

While incumbent ISPs are wary of the new competition from Starlink’s low Earth orbit satellites, traditional wireline telcos are no guarantee to meet FCC deployment requirements. CenturyLink and Frontier recently missed FCC deployment deadlines in dozens of states, and both of them are slated to get more money from the new RDOF program.

https://arstechnica.com/?p=1740946

A trio of Democratic Senators has taken this administration’s first stab at Section 230 reform with a new bill that would make platforms, including giants such as Facebook and Twitter, liable for certain limited categories of dangerous content. Unfortunately, although the bill’s authors try to thread a tricky needle carefully, critics warn that bad-faith actors could nonetheless easily weaponize the bill as written against both platforms and other users.

The bill (PDF), dubbed the SAFE TECH Act, seeks not to repeal Section 230 (as some Republicans have proposed) but instead to amend it with new definitions of speakers and new exceptions from the law’s infamous liability shield.

“A law meant to encourage service providers to develop tools and policies to support effective moderation has instead conferred sweeping immunity on online providers even when they do nothing to address foreseeable, obvious and repeated misuse of their products and services to cause harm,” said Sen. Mark Warner (D-VA), who introduced the bill. “This bill doesn’t interfere with free speech—it’s about allowing these platforms to finally be held accountable for harmful, often criminal behavior enabled by their platforms to which they have turned a blind eye for too long.”

Sens. Mazie Hirono (D-HI) and Amy Klobuchar (D-MN) also co-sponsored the bill.

What does Section 230 do?

Section 230 of the Communications Decency Act of 1996, as it currently stands, does two major things in two small sections.

The first section reads:

No provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider.

That means that both Internet services that bring you information (Facebook, Twitter, etc.) are not considered to be the entities who “say” something posted or transmitted by a third party. In short: if John Doe defames Jane Smith in a series of posts he makes on Twitter, it is John Doe, not Twitter, who is responsible for that defamation. It also applies to third-party content in areas such as comments sections on news websites.

The second relevant section is a liability shield that grants platforms protection from lawsuits related to content third parties (the “publishers” or “speakers”) post on those platforms—and, critically, from lawsuits related to moderation choices those platforms make. The law does not require a platform to employ content moderation, but it does provide a liability shield from being sued over “any action voluntarily taken in good faith to restrict access to or availability of” problematic material. In practice, Sec. 230 means a platform can’t really be sued for the amount of moderation it performs or for moderation that happens to miss some posts.

The liability shield gives providers a great deal of discretion in how to handle content they deem to be, “obscene, lewd, lascivious, filthy, excessively violent, harassing, or otherwise objectionable.” Contrary to popular political claims, however, there is nothing whatsoever in the law about political neutrality, and it contains no language about “editorial control.”

What would SAFE TECH change?

The proposed bill would drastically alter section 1(a), quoted above, to read:

No provider or user of an interactive computer service shall be treated as the publisher or speaker of any speech provided by another information content provider, except to the extent the provider or user has accepted payment to make the speech available or, in whole or in part, created or funded the creation of the speech.

The change, Sen. Warner explained, is intended directly to target online advertising, which is now omnipresent. If someone on Twitter makes a bad tweet, as happens every day, nothing changes. If someone pays Twitter to promote a bad tweet, however, Twitter itself could be considered the “speaker” of the content in that ad.

The proposal also explicitly creates new carve-outs from the “Good Samaritan” liability shield that protects platforms from lawsuits. Users would be able to file lawsuits for injunctive relief (i.e., a court order requiring someone to stop doing something) for unmoderated material that “is likely to cause irreparable harm.” Basically, if someone is harassing you on Twitter, and every report to Twitter about the offending tweets is returned with a version of “this doesn’t violate our guidelines,” you could in theory go to court to demand Twitter take the harassing posts down.

SAFE TECH also adds a litany of new exceptions to the section of the law that governs how it interacts with other laws, adding civil rights laws; antitrust laws; stalking, harassment, or intimidation laws; international human rights law; and wrongful death actions to the list of laws on which Sec. 230 has no effect.

The “red-lined” version of the bill (PDF) shows where the edits would fit into the current law.

Narrow exceptions, wide consequences

Several legal experts and lawmakers have warned that the changes in this draft bill could, if enacted, have wide-ranging and unintended consequences.

“Unfortunately, as written, [SAFE TECH] would devastate every part of the open Internet, and cause massive collateral damage to online speech,” Sen. Ron Wyden (D-Ore.), said to TechCrunch. “Creating liability for all commercial relationships would cause web hosts, cloud storage providers and even paid email services to purge their networks of any controversial speech.”

Law Professor Jeff Kosseff, who literally wrote the book on Sec. 230, had similar misgivings.

The bill “is well intentioned, but the drafting lacks precision and courts could read it as removing [Sec.] 230 protections from nearly every platform on the Internet,” Kosseff wrote on Twitter. “A good lawyer could argue that a very wide range of arrangements constitute the acceptance of payment to make the speech available.”

Fight for the Future director Evan Greer also worried that the definition of “payment” in the bill is much too broad. “As far as I can tell this bill as written would essentially destroy Bandcamp, Patreon, Wikipedia, Craigslist, Etsy, any individual musician or artist or nonprofit online seller with a store on their website, crowdfunding platforms, etc etc,” Greer wrote. “It’s a mess.”

We have some real-world experience with unintended consequences of Sec. 230 amendments: the law has been narrowly altered in the very recent past to exclude certain categories of content, to decidedly mixed effect.

In 2018, a pair of bills known as FOSTA/SESTA became law. (FOSTA was the House version; SESTA the Senate edition.) The bills were designed to limit sexual exploitation and sex trafficking online by adding a carve-out to Sec. 230 to strip liability protections from “websites that unlawfully promote and facilitate prostitution and websites that facilitate traffickers in advertising the sale of unlawful sex acts with sex-trafficking victims.”

After FOSTA/SESTA became law, however, exploitation still persists—and what we got instead was devastation of legal and consenting sex work facilitated by the internet. Adult entertainers lost access to the platforms where they had advertised and worked, instead making their jobs less safe and giving sex workers less control over where and how they work.

You gotta have (bad) faith

Kosseff, in his Twitter thread, ended with a warning to those who would alter Sec. 230: “Think not only about the ways that you want people to use the amended 230, but think about how it could be used in ways that you do not intend,” he cautioned. “Because chances are, it will.”

There’s a long litany of legitimate concerns and criticisms one might have with the way social media platforms have approached moderation in the past several years. Efforts to revise Sec. 230—both genuine, good-faith attempts at an update and bad-faith attempts at killing it—abounded during the last years of the Trump administration.

Broadly speaking, the fight breaks down along partisan lines. Democrats and progressives tend to argue platforms should moderate more and act more quickly to remove blatant disinformation and harmful speech. Republicans and conservatives, on the other hand, tend to claim that any moderation, especially if applied to them, is tantamount to “censorship” and that platforms demonstrate an inherent “bias” against conservative voices.

Former President Donald Trump launched an all-out assault on Sec. 230 in 2020, urging the Federal Communications Commission, the Department of Justice, and the Federal Trade Commission to adopt new rules that would limit platforms’ ability to moderate content and would allow users who had their content moderated to sue. The FCC considered a proposal to limit Sec. 230, and the DOJ sent Congress a draft bill, but ultimately both efforts went nowhere before the end of the administration.

Recent studies have found that these claims of bias are themselves disinformation and that conservative speakers have, in fact, dominated social media in recent years. Nonetheless, the partisan arguments are continuing and are likely to continue to do so for quite some time. Rep. Ted Budd (R-NC) already introduced a bill this year that would allow anyone to sue a platform that “breach[es] good-faith user agreements, censor[s] political speech, and suppress[es] content.”

https://arstechnica.com/?p=1740477

The Biden administration has abandoned a Trump-era lawsuit that sought to block California’s net neutrality law. In a court filing today, the US Department of Justice said it “hereby gives notice of its voluntary dismissal of this case.” Shortly after, the court announced that the case is “dismissed in its entirety” and “all pending motions in this action are denied as moot.”

The case began when Trump’s DOJ sued California in September 2018 in US District Court for the Eastern District of California, trying to block a state net neutrality law similar to the US net neutrality law repealed by the Ajit Pai-led FCC. Though Pai’s FCC lost an attempt to impose a blanket, nationwide preemption of any state net neutrality law, the US government’s lawsuit against the California law was moving forward in the final months of the Trump administration.

The Biden DOJ’s voluntary dismissal of the case puts an end to that. “I am pleased that the Department of Justice has withdrawn this lawsuit,” FCC Acting Chairwoman Jessica Rosenworcel said today. “When the FCC, over my objection, rolled back its net neutrality policies, states like California sought to fill the void with their own laws. By taking this step, Washington is listening to the American people, who overwhelmingly support an open Internet, and is charting a course to once again make net neutrality the law of the land.”

ISPs still fighting state law

California still has to defend its net neutrality rules against a separate lawsuit filed by the major broadband-industry lobby groups. The industry groups representing all the biggest ISPs and many smaller ones filed an amended complaint against California in August 2020, claiming the net neutrality law is “unconstitutional state regulation.”

“Those of us who support SB822, the California law, believe that challenges to the law lack a valid basis,” Andrew Jay Schwartzman, senior counselor at the Benton Institute for Broadband & Society, told Ars today. “In light of the fact that the FCC disclaimed any jurisdiction over broadband Internet service, the FCC’s claim of a policy of ‘non-regulation’ leaves the states free to regulate.”

Schwartzman and the Benton Institute are helping California defend the law in court. A hearing on the industry’s motion for preliminary injunction is scheduled for February 23, Schwartzman said.

Back in October 2018, California agreed to suspend enforcement of its law until litigation is over. The state law prohibits Internet service providers from blocking or throttling lawful traffic. It also prohibits requiring fees from websites or online services to deliver or prioritize their traffic to consumers, bans paid data cap exemptions (so-called “zero-rating”), and says that ISPs may not attempt to evade net neutrality protections by slowing down traffic at network interconnection points.

“Good start” toward restoring net neutrality

The FCC is likely to reinstate net neutrality rules during the Biden administration but can’t do so yet as the commission is deadlocked 2-2 between Democrats and Republicans. A new Democratic commissioner must be nominated by Biden and approved by the Senate.

“The Biden administration must restore net neutrality, and dropping this case is a good start,” Joshua Stager, senior counsel at New America’s Open Technology Institute, said today.

The Trump administration lawsuit was “a frontal attack on both net neutrality and California’s right to protect consumers,” Stager said. California lawmakers passed the law “to ensure that Californians get the Internet service they paid for without unreasonable interference from their Internet provider. That law is needed now more than ever as millions of Californians rely on Internet service to get through simultaneous public health, economic, and climate crises. The Department of Justice never should have stood in the way of this law.”

https://arstechnica.com/?p=1740656

Someone broke into the computer system of a water treatment plant in Florida and tried to poison drinking water for a Florida municipality’s roughly 15,000 residents, officials said on Monday.

The intrusion occurred on Friday evening, when an unknown person remotely accessed the computer interface used to adjust the chemicals that treat drinking water for Oldsmar, a small city that’s about 16 miles northwest of Tampa. The intruder changed the level of sodium hydroxide to 11,100 parts per million, a significant increase from the normal amount of 100 ppm, Pinellas County Sheriff Bob Gualtieri said in a Monday morning press conference.

A press release is here.

Better known as lye, sodium hydroxide is used in small amounts to treat the acidity of water and to remove metals. It’s also the active ingredient in liquid drain cleaners. It higher levels, it’s toxic. Had the change not been reversed almost immediately, it would have raised the amount of chemical to toxic levels.

“This is obviously a significant and potentially dangerous increase,” Gualtieri told reporters. “At no time was there a significant adverse effect on the water being treated. Importantly, the public was never in danger.”

So far, authorities have made no arrests, but they are chasing down several leads. Gualtieri said it’s not clear if the intrusion came from inside or outside the US. Both the FBI and Secret Service are also investigating. The sheriff’s department has alerted area municipalities to the attack and recommended they inspect their water treatment systems and other infrastructure for signs of a breach.

The first signs that anything might be amiss occurred on Friday morning, when a plant operator noticed someone had remotely accessed a system that controls chemicals and other aspects of the water treatment process. Gualtieri said the operator didn’t think much of the incident since his supervisor and co-workers regularly logged into the remote system to monitor operations.

Then, around 1:30 that same day, the operator watched as someone remotely accessed the system again. The operator could see the mouse on his screen being moved to open various functions that controlled the treatment process. The unknown person then opened the function that controls the input of sodium hydroxide and increased it by 111-fold. The intrusion lasted from three to five minutes.

The operator immediately changed the setting back to the normal 100 ppm, the sheriff said. Even if the malicious change hadn’t been reversed, he said the other routine procedures in the plant would have caught the dangerous level before the water became available to residents. It takes 24 to 36 hours for treated water to hit the supply system. No poisonous water was ever released.

The incident is certain to renew the debate over whether processes for utilities and other critical infrastructure should be exposed to the internet. The Pinellas County Sheriff’s Department didn’t immediately respond to a question asking if the utility required personnel to use two-factor authentication to gain remote access to interfaces like the one that was breached in Oldmar. Reuters, citing an interview with Gualtieri, reported that Teamviewer was the application used to gain remote access, but the department didn’t immediately respond to this question either.

Jake Brodsky, an engineer with 31 years experience working in the water industry, said it’s not at all uncommon for water utilities to make such interfaces available remotely. While he frowns on the practice, he said that Gualitieri was probably correct when he said the public was never in danger.

“There’s a bunch of different things [water utilities] look for, and if they see anything out of kilter, they can then isolate the storage water,” he said in an interview. “The danger here is relatively minimal as long as you catch it soon enough and there are multiple checks before that happens.”

Of course, if intruders can remotely tamper with a process, they may also be able to tamper with the safety redundancies in place. If Brodsky were advising Oldsmar officials on better securing their water treatment plant, “the first thing I’d probably do, and this almost doesn’t cost anything, is you disable the remote access,” he said. When remote access is required, as occasionally is the case, connections should be manually allowed by someone physically present and the access should time out after a brief period of time.

“I can’t imagine leaving a connection like that open and exposed to the world,” Brodsky said. “This is cheap and easy. All you do is call the operator and you get the access.”

https://arstechnica.com/?p=1740652