In one of his last acts as Federal Communications Commission chairman, Ajit Pai decided to stick with the FCC’s 6-year-old broadband standard of 25Mbps download and 3Mbps upload speeds.

The decision was announced yesterday in the FCC’s annual broadband-deployment report, released one day before Pai’s departure from the FCC. As in all previous years of Pai’s chairmanship, the report concludes that the telecom industry is doing enough to extend broadband access to all Americans—despite FCC Democrats saying the facts don’t support that conclusion.

Pai’s report said:

We find that the current speed benchmark of 25/3Mbps remains an appropriate measure by which to assess whether a fixed service is providing advanced telecommunications capability. We conclude that fixed services with speeds of 25/3Mbps continue to meet the statutory definition of advanced telecommunications capability; that is, such services “enable[] users to originate and receive high-quality voice, data, graphics, and video telecommunications.”

Under US law, the FCC is required to determine annually whether “advanced telecommunications capability is being deployed to all Americans in a reasonable and timely fashion” and to “take immediate action to accelerate deployment” and promote competition if current deployment is not “reasonable and timely.” Maintaining the 25/3Mbps standard for home-Internet services, which hasn’t been changed since January 2015, makes it easier for Pai to give the telecom industry and FCC a passing grade on the annual report. Pai’s annual reports also evaluated deployment of mobile Internet at different speeds, but he didn’t adopt a single speed benchmark for determining whether a mobile service is “advanced.”

FCC Democrat Jessica Rosenworcel, who could be the commission’s next chair, has repeatedly argued that the FCC should adopt a higher speed benchmark for home-Internet service. “With so many of our nation’s providers rolling out gigabit service, it’s time for the FCC to adjust its baseline upward, too,” she said last year, calling for a 100Mbps download standard and an upload standard that’s higher than 3Mbps.

“At present, our standard is 3 megabits per second,” she said. “But this asymmetrical approach is dated. We need to recognize that with extraordinary changes in data processing and cloud storage, upload speeds should be rethought.”

Pai: ISPs are doing enough despite rural gaps

The report released yesterday concluded that “advanced telecommunications capability is being deployed on a reasonable and timely basis” and that the “rural–urban divide is rapidly closing; the gap between the percentage of urban Americans and the percentage of rural Americans with access to 25/3Mbps fixed broadband has been nearly halved, falling from 30 points at the end of 2016 to just 16 points at the end of 2019.”

In a press release, Pai played up his alleged role in expanding broadband access, saying, “from my first day as Chairman, the FCC’s top priority has been closing the digital divide.” In addition to expansion of home-Internet services, he pointed to FCC data showing that “at the end of 2019, mobile providers offered 5G service to approximately 60 percent of Americans, a figure that is substantially higher today.”

Pai today also released a list of what he considers to be his accomplishments as FCC chairman, including “Restoring Internet Freedom”—his phrase for deregulating the broadband industry and eliminating net neutrality rules.

Pai’s victory laps are “unseemly”

FCC Democrats objected to Pai finalizing the broadband-deployment report yesterday instead of letting the task pass to the Biden administration.

“Over the last two years, I have decried the unwarranted victory laps these reports seem to spawn,” FCC Commissioner Geoffrey Starks said. “Now—as tens of millions of Americans find themselves unable to access online school, work, and healthcare during the pandemic—patting ourselves on the back is particularly unseemly.”

Despite Pai’s rosy conclusions—and the inaccuracy of FCC data, which tends to undercount Americans without broadband access—the report has evidence to back up Starks’ concerns about the continuing digital divide. As of year-end 2019, only 4.4 percent of Americans lived in areas without access to 25/3Mbps home-Internet service, but the data for rural and tribal areas paints a much uglier picture. At 25/3Mbps home-Internet speeds, there’s no coverage for 17.3 percent of rural areas and no coverage for 20.9 percent of tribal areas. Overall, there are about 65 million people in the rural areas in FCC data and about 4 million people in tribal areas.

Nearly 99 percent of urban areas had 25/3Mbps access, and 95 percent of urban areas had access even at 250/25Mbps speeds. But only 66.8 percent of rural areas and 63.7 percent of tribal areas had access to 100/10Mbps speeds, while 55.6 percent of rural areas and 49.6 percent of tribal areas had access to 100/10Mbps speeds:

This data is based on census blocks and counts an entire census block as served even if only one home in the census block can get service. Pai’s FCC began the process of collecting geospatial data from ISPs to improve accuracy, but that task will be finished under whomever President Biden chooses to serve as FCC chair.

Evidence contradicting Pai is “all around us”

Rosenworcel said that Pai’s report obscures “the hard truth that the digital divide is very real and very big” and that “it confounds logic that today the FCC decides to release a report that says that broadband is being deployed to all Americans in a reasonable and timely fashion.”

The evidence contradicting Pai’s conclusions is “all around us,” Rosenworcel continued:

There are people sitting in parking lots using free Wi-Fi signals because they have no other way to get online. There are students who fall in the homework gap because the lack the high-speed service they need to participate in remote learning. There are mayors in towns across the country clamoring for better broadband so their communities have a fair shot at digital age success.

When Biden defeated Trump in the election, Congressional Democrats called on Pai to follow the past practice of stopping “work on all partisan, controversial items” during the transition period. Pai never committed to doing so—despite taking the opposite stance four years earlier when then-Chairman Tom Wheeler complied with an equivalent request from Congressional Republicans.

Starks argued that yesterday’s report was too controversial to be approved when the FCC is about to change hands from Republicans to Democrats. Starks said:

I am compelled to note that this Report should not have been released at all. After the election in November, congressional leaders wrote to Chairman Pai to demand that the Commission stop work on all partisan and controversial items during the presidential transition. This item is both.

Nonetheless, Chairman Pai declined to withdraw the Report as Commissioner Rosenworcel and I requested. His rationale—that the Report has no legal significance—is plainly inconsistent with the Telecommunications Act, which directs the Commission to take “immediate action” if it determines that advanced telecommunications capability is not being deployed to all Americans on a reasonable and timely basis. That determination should have been left to the next administration, which could have addressed the question before the statutory deadline.

“Haste and waste” in FCC subsidies

Pai has continually claimed that his deregulatory agenda boosted broadband deployment, despite evidence to the contrary found in statements ISPs made to investors and recent cuts in big ISPs’ network spending. Pai has also touted data showing broadband progress even after FCC staff warned it was based on incorrect filings by an ISP.

Even Pai’s most direct efforts to close the digital divide have been controversial. Pai replaced the FCC’s Connect America Fund with a similar Rural Digital Opportunity Fund and recently awarded $9.2 billion worth of funding that will be distributed over 10 years. But instead of waiting for more accurate broadband data to better target the funding to areas that need it most, Pai went ahead with the funding distribution weeks before his departure from the FCC.

The subsidies are supposed to go to “high-cost” areas where ISPs would not have a good business case for deployment without government funding. But consumer-advocacy group Free Press has been examining the funding awards in a series of reports, saying in one report that Pai’s program is “subsidiz[ing] broadband for the rich.”

Some funding went to census blocks “located inside of the service footprints of Comcast” and other ISPs, places with little demand for broadband “either because no one lives or even works there, or because for the most part they have no residential properties and the few businesses there may not need advanced services,” Free Press wrote in another analysis yesterday. Pai’s broadband legacy is one of “haste and waste,” the group said.

A bipartisan group of 157 members of Congress yesterday sent a letter urging Pai and other FCC commissioners to make sure the funds aren’t spent improperly:

We urge the FCC to validate that each provider in fact has the technical, financial, managerial, operational skills, capabilities, and resources to deliver the services that they have pledged for every American they plan to serve regardless of the technology they use.

Americans “need an FCC that fights for them”

Advocates for stricter regulation of broadband providers are happy to see Pai leave. In four years as chairman, Pai “embraced a radical agenda that rolled back consumer protections, rubber-stamped corporate wish lists, and even weakened his own agency’s legal authority,” Senior Counsel Joshua Stager of New America’s Open Technology Institute said yesterday, referring to Pai’s decision to abandon the FCC’s Title II regulatory authority over broadband providers. “We look forward to turning the page on this chapter of FCC history and urge new leadership to set a new course. The American people still need an FCC that fights for them.”

https://arstechnica.com/?p=1736354

Florida police have arrested former state data scientist Rebekah Jones, accusing her of breaking state laws prohibiting accessing computer systems without authorization.

Jones on Saturday disclosed the arrest warrant herself, writing in a series of tweets that she and her lawyer had arranged with Florida police for her to present herself to law enforcement in Tallahassee on Sunday evening. (Jones and her family currently live in the Maryland suburbs of Washington, DC.) Jones was released from jail Monday after posting $2,500 bail and reportedly testing positive for COVID-19 while in police custody.

The warrant alleges that Jones gained unauthorized access to state Department of Health systems in November to send an unauthorized message to employees and to download a list of contact information for approximately 19,000 people.

Jones built and managed Florida’s COVID-19 data dashboard from its launch in March until May 5, at which point she and her team were removed from the project. Later that month, Jones said publicly that she was not only removed from the dashboard project but also fired from her job because she refused to alter or manipulate COVID-19 data to support the state’s plan to rapidly reopen restaurants and other businesses. After she and the Sunshine State parted ways, Jones launched her own independent COVID data-reporting platform.

On November 10, an unknown person sent an “unauthorized message” to roughly 1,750 members of a Florida Department of Health emergency response team. That message urged recipients to “speak up before another 17,000 people are dead,” adding, “You know this is wrong. You don’t have to be a part of this. Be a hero. Speak out before it’s too late.”

“They pointed guns at my kids”

Investigators probed the unauthorized message and, by early December, determined Jones was their suspect. State police raided her home in the first week of December to seize some, but reportedly not all, of the electronic devices in her house.

“They pointed a gun in my face. They pointed guns at my kids,” Jones said in a Twitter thread at the time. “They took my phone and the computer I use every day to post the case numbers in Florida, and school cases for the entire country. They took evidence of corruption at the state level.” She explicitly accused the administration of Florida Gov. Ron DeSantis of using the police action to try to intimidate and silence her, adding, “This was DeSantis. He sent the gestapo… this is DeSantis’ Florida.” The DeSantis administration at the time denied having anything to do with the incident.

The statute Jones was accused of violating in the arrest warrant prohibits anyone from “willfully, knowingly, and without authorization or exceeding authorization accesses or causes to be accessed any computer, computer system, computer network, or electronic device with knowledge that such access is unauthorized or the manner of use exceeds authorization.”

As Ars reported at the time, however, not only do thousands of state employees share the same username and password for accessing the system Jones allegedly breached, but also the credentials for accessing that system were publicly available on the Internet for anyone to find and use. Court records show that the Florida DOH added a two-factor authentication requirement to its systems after the unauthorized message was sent in November.

Jones vehemently denies having anything to do with the message. “[Florida police] found no evidence of a message sent last Nov. to DOH staff telling them to ‘speak out’ on any of the devices they took–the entire basis for the raid on my home in Dec.,” she wrote on Twitter. “The raid was based on a lie Still, the state has issued a warrant for my arrest—even though the ‘crime’ is not related to the warrant, the scope of the warrant, and they didn’t wait for a third party to review confidential information on my computers.”

https://arstechnica.com/?p=1736147

Today, the US Court of Appeals for the District of Columbia vacated the Trump administration’s attempt to take a minimalist approach to the regulation of carbon dioxide emissions. The ruling was a lopsided victory for the long list of groups opposing the Trump EPA’s approach, with the entire rule being vacated. Thus, the Biden administration will start unencumbered by its predecessors’ attempts to gut carbon dioxide regulations.

Here we go again

Some of the legal issues here date back to the Clinton administration, when states sued to force the EPA to regulate carbon emissions under the Clean Air Act. That issue was ultimately clarified by the Supreme Court, which, during the George W. Bush administration, ruled that carbon dioxide could be regulated as a pollutant as defined by the Clean Air Act. Early in the Obama administration, the EPA issued an endangerment finding for greenhouse gasses that provided the scientific rationale for regulations. Those regulations came in the form of the Clean Power Plan, issued during Obama’s second term.

While the Clean Power Plan completed the federal rule-making process, it was held up by lawsuits when President Obama left office. Trump issued an executive order that directed the EPA to replace the Clean Power Plan. The EPA’s eventual replacement, the Affordable Clean Energy rule (ACE), went well beyond simply ending or limiting the Clean Power Plan. Instead, the ACE attempted to narrow the regulation allowed under the Clean Air Act by having states regulate each individual source of emissions rather than regulating the state’s total emissions. As an added bonus, it also stretched out the timeline for states to bring their emissions into compliance.

Under this view, the EPA’s regulations could only force existing coal-operating plants to function more efficiently; the rules couldn’t promote having them switch fuels to natural gas or biomass, much less have them closed and replaced by natural gas or renewable power sources. Needless to say, this approach was pretty ineffectual at limiting carbon emissions, and the EPA itself predicted that the ACE would cause them to fall by only 1 percent.

Not even wrong

The new ruling eviscerates the EPA’s logic, finding it so flawed that the entire rule has been vacated.

“The central operative terms of the ACE Rule and the repeal of its predecessor rule, the Clean Power Plan, hinged on a fundamental misconstruction of… the Clean Air Act,” the decision reads. “In addition, the ACE Rule’s amendment of the regulatory framework to slow the process for reduction of emissions is arbitrary and capricious.”

The ruling’s primary focus is on Section 7411 of the Clean Air Act, which indicates that EPA regulations could compel changes in pollution “achievable through the application of the best system of emission reduction.” The EPA wanted to interpret this as meaning the best system that could be applied at individual sources of pollution, such as a single power plant, rather than treating the power grid as a unified system. The court found that this reasoning came up short—and badly short—writing, “It fails for at least three reasons, any of which is alone fatal.”

The court noted that Section 7411 has a list of limitations on its applicability, and none of them include the idea that the EPA is limited to considering individual sources. In addition, the EPA’s interpretation of the Section requires the insertion of words that aren’t present in the statute’s text. Finally, to cancel an existing rule, the EPA’s interpretation has to be the only one that’s consistent with Section 7411’s language, which the court notes is clearly not true.

The ruling also held that the EPA wasn’t even internally consistent when making its decision, saying, “Recognizing that sources generally have ‘broad discretion’ in how they comply with state standards, the EPA nonetheless categorically excluded two specific measures from the States’ consideration: averaging and trading, and biomass co-firing.” This inconsistency makes sense if the EPA specifically wanted to encourage coal use (the EPA head at the time was a former coal lobbyist), but it doesn’t make for federal rule-making that holds up to legal challenge.

Odds and ends

The EPA had also argued that its new interpretation required a review under something called the “Major Questions Doctrine,” but the court found that unpersuasive, as the EPA had been managing regulations under its previous view of Section 7411 for decades. Many of these regulations had withstood multiple legal challenges. Oddly, two coal mining companies joined the suit claiming that the ACE was adopted without an endangerment finding; the court dismissed this due to the fact that the earlier greenhouse gas endangerment finding was still operative. Other groups that sued lacked standing, as their only claim for joining the case was that they paid for electricity.

The court also rejected the EPA’s attempt to lengthen the timeline for states to bring their electric grids into compliance, which would delay even the feeble emissions cuts that would result from the ACE. In essence, the court found that there was insufficient reason given for these changes: “Because the challenged regulations lack reasoned support, they cannot stand.”

In its decision, the court cites the US’s National Climate Assessment in providing a rationale for regulating greenhouse gas emissions. The court notes that the assessment concluded, “The evidence of human-caused climate change is overwhelming and continues to strengthen” and “the impacts of climate change are intensifying across the country.” The importance assigned to the assessment is likely why the Trump administration placed noted climate contrarians at NOAA in what was thought to be an attempt to weaken the next edition of the National Climate Assessment.

Where to go from here

The federal rule-making process that established the ACE also eliminated the Clean Power Plan, and the court’s decision doesn’t revive it, according to Ben Levitan, a senior attorney at the Environmental Defense Fund. Levitan said at this point, it was unclear whether anyone involved in the case will seek further review, as there were a number of parties beyond the EPA involved (the list of parties occupies 13 pages of the decision). But it’s safe to assume that the Biden EPA is unlikely to want to appeal a decision that, in Levitan’s view, rejected an attempt to “undermine the Clean Air Act and deprive Americans of the protections they deserve.”

Which means that the Biden administration will likely start from scratch. And given the changes that have taken place since the Obama administration, that’s almost certainly the most appropriate course. Due to the plunging prices of renewable energy, fossil fuels in 2021 will account for less than 20 percent of the new generating capacity added to the US grid, and all of it will be natural gas, furthering the precipitous decline of coal use. Biden also intends to promote an even higher pace of renewable energy use as part of his pandemic recovery package.

Given those facts, the original Clean Power Plan has been made obsolete, and any future regulations would need to reflect the new reality.

https://arstechnica.com/?p=1736209

Charter Communications has withdrawn a petition seeking government permission to impose data caps on broadband users this year.

Unlike other ISPs, Charter is subject to the prohibition on data caps and overage fees until May 2023 because of seven-year conditions applied to its 2016 purchase of Time Warner Cable. In June 2020, Charter petitioned the Federal Communications Commission to let the condition expire two years early, on May 18, 2021.

FCC Chairman Ajit Pai sought public comment on the petition but never took final action, even though he had opposed the merger conditions when they were imposed by the Obama-era FCC. With Pai leaving the FCC upon President-elect Joe Biden’s inauguration tomorrow, Charter submitted a brief filing stating that it “respectfully withdraws its petition.”

“VICTORY”

“Hey hey! Charter just withdrew its despicable petition to start implementing data caps in the middle of a pandemic! That right there is what we call a VICTORY,” tweeted Dana Floberg, policy manager for consumer-advocacy group Free Press. The group previously urged the FCC to reject the petition, writing:

The COVID-19 pandemic has made it abundantly clear that unlimited home broadband connections are a necessary utility service. The evidence from April through June, when most ISPs suspended their caps, demonstrates that ISP data caps and overage fees are completely unnecessary abuses of market power. All networks performed well while their operators continued to earn high profit margins, as usage skyrocketed.

Charter is the second-biggest home-Internet provider in the US after Comcast and sells broadband service under the Spectrum brand name.

FCC switching to Democratic control

Charter’s latest FCC filing didn’t say why it withdrew the petition, but its request would have faced longer odds in the Biden administration with Democrats controlling the FCC. Pai’s departure will leave the FCC with a 2-2 split between Republicans and Democrats until a new commissioner is nominated by Biden and approved by the Senate. In the meantime, Biden is expected to promote one of the two current Democrats—Jessica Rosenworcel or Geoffrey Starks—to the chair position on at least an interim basis.

Besides banning data caps, the FCC-imposed merger conditions also prohibited Charter from charging large online video streaming services for network interconnection. The conditions were imposed under then-FCC Chairman Tom Wheeler to prevent Charter from using its enhanced market power against online video providers that offer service over Charter’s broadband network.

But the free-interconnection requirement was nullified by the US Court of Appeals for the District of Columbia Circuit in August. The Pai-led FCC did not defend the merits of the merger condition in court, paving the way for that ruling. The ruling did not affect the data-cap ban.

Despite imposing the conditions for seven years, the Wheeler FCC’s 2016 merger order said Charter could petition for the conditions to be lifted after five years.

Charter claimed users like plans with data caps

After filing its petition to the FCC last year, Charter said it had no intention of imposing data caps. “Once the conditions expire, Charter will weigh the options as we would any business decision but is currently not even considering implementing data caps or charging for interconnection and has no plan to do so,” the company told Ars at the time. “What Charter seeks is a level playing field so that we can continue to grow and provide superior service to our customers across the country.”

But as the proceeding moved on, Charter claimed in an FCC filing that broadband users enjoy having Internet plans with data caps. “[T]he marketplace currently shows that broadband service plans incorporating data caps or other usage-based pricing mechanisms are often popular when the limits are sufficiently high to satisfy the vast majority of users,” Charter told the FCC, months before withdrawing the petition.

When asked why it withdrew the petition today, a Charter spokesperson noted that the merger conditions have already been partially overturned in court. Charter also told Ars it wants to assure customers that their unlimited data is not going away:

In light of the ongoing severity of the global pandemic and its effects on our customers, we want to offer them the assurance that they will continue to benefit from unlimited access to broadband and the accompanying financial certainty it provides during these trying times, and therefore have withdrawn our petition.

Charter has not taken advantage of the court ruling to impose interconnection fees. “We have no plans at this time to charge interconnection fees,” the Charter spokesperson told Ars.

The FCC today issued a public notice acknowledging Charter’s withdrawal of the petition. “Pursuant to the terms of the Order approving the merger, all conditions that remain in effect will expire on May 18, 2023, seven years from the Closing Date of the transaction,” the FCC said.

Disclosure: The Advance/Newhouse Partnership, which owns 13 percent of Charter, is part of Advance Publications. Advance Publications owns Condé Nast, which owns Ars Technica.

https://arstechnica.com/?p=1736113

Right-wing social media platform Parler, which has been offline since Amazon Web Services dropped it like a hot potato last week, has reappeared on the Web with a promise to return as a fully functional service “soon.”

Although the platform’s Android and iOS apps are still defunct, this weekend its URL once again began to resolve to an actual website instead of an error notice. The site at the moment consists solely of the homepage, which has a message from company CEO John Matze.

“Now seems like the right time to remind you all—both lovers and haters—why we started this platform,” the message reads. “We believe privacy is paramount and free speech essential, especially on social media. Our aim has always been to provide a nonpartisan public square where individuals can enjoy and exercise their rights to both. We will resolve any challenge before us and plan to welcome all of you back soon. We will not let civil discourse perish!”

Parler, however, was deplatformed in the first place explicitly because the content it allowed to flourish was anything but “civil,” and as multiple reports have made clear, the service backend was designed with basically no thought given to privacy. Meanwhile, the path Parler appears to be taking to rejoin the Internet is a shady one paved for it by other explicitly extremist, white nationalist platforms that lost access to more mainstream services after being tied to terrorism.

Three strikes

Parler’s deplatforming began in the wake of the insurrectionist riots at the US Capitol the week before, as it became clear a number of Parler users who had used the platform to make threats were in fact present in the mob that stormed the building.

The insurrectionists who gathered in the District of Columbia on January 6 not only planned out their attack using social media platforms but also used those platforms—especially Parler—while they were at the Capitol. Many major media outlets reported before, during, and after the events of January 6 that the rioters were using Parler to organize.

Google booted Parler from the Android app store on January 8, citing its failures to take down explicitly “egregious content” that incited violence. Apple followed suit a few hours later, suspending Parler from the iOS App Store over its failure to remove “threats of violence and illegal activity” in accordance with the Apple developer agreement.

The final blow for Parler followed that weekend, when AWS stopped providing Web-hosting services to the platform and called it a “very real risk to public safety.”

“It’s clear that Parler does not have an effective process to comply with the AWS terms of service,” the company wrote in an email to Parler. “You remove some violent content when contacted by us or others, but not always with urgency. Your CEO recently stated publicly that he doesn’t ‘feel responsible for any of this, and neither should the platform.’ … It’s our view that this nascent plan to use volunteers to promptly identify and remove dangerous content will not work in light of the rapidly growing number of violent posts.”

Parler turned right around and sued Amazon over the ban, petitioning the court for immediate reinstatement. So far, however, that suit has only made clear just how much violent content Parler was apparently willing to host, as Amazon in its legal response brought (truly vile) receipts showing what kind of content it had explicitly been warning Parler about for months.

About that privacy…

In the roughly 24 hours between the time that Amazon warned Parler it was going to terminate the company’s service and the time the platform finally went offline, a quick-thinking researcher managed to scrape and archive almost all of Parler’s public content—which, due to poor coding choices on Parler’s part, meant she was able to access not only some deleted posts but also a trove of metadata, including precise GPS locations for user videos.

Researchers, journalists, and law enforcement have since been able to use that data to pull together a fairly comprehensive picture of what went on inside the Capitol that day—and who was there doing it.

Gizmodo quickly used the GPS data to pull together a map showing that there were hundreds of videos posted to Parler from the Capitol grounds or inside the building on January 6. Another researcher made an interactive map linking the videos to the location pins for easy viewing. And over the weekend, ProPublica published a comprehensive timeline comprising more than 500 videos from Parler to show the events of the day, from President Donald Trump’s speech near the White House to the eventual breakup of the mob in the early evening.

Federal authorities have already made more than a hundred arrests related to the attack at the Capitol. Court documents show many of the suspects currently under arrest were using social media, including Parler, to share images, videos, or live broadcasts of their alleged crimes.

The road back to visibility

Parler has apparently secured hosting from Epik to bring itself back online. Epik is best known for helping far-right extremist platform Gab to come back online a short time after a Gab user committed a mass murder at a Pittsburgh synagogue in 2018; it has also provided services to other white nationalist, anti-Semitic, and neo-Nazi platforms including 8chan (now known as 8kun) and The Daily Stormer.

Multiple security researchers have also pointed out that Parler appears to have secured the services of DDoS-Guard, a cloud services company based in Russia.

Cybersecurity expert Brian Krebs last year published an analysis of potential legal liabilities DDoS-Guard might face inside the United States due to its client list. Krebs called the list “revelatory,” noting it includes “a vast number of phishing sites and domains tied to cybercrime services or forums.”

Most notably, DDoS-Guard also provides hosting services to Hamas, which the US has classified as a terrorist organization for more than 20 years.

https://arstechnica.com/?p=1735762

GitHub Inc. yesterday apologized for firing a Jewish employee who had urged colleagues to “stay safe” and avoid “Nazis” on the day a mob incited by President Trump stormed the US Capitol. GitHub said it “reversed the decision” and indicated it is trying to hire the employee back.

“Stay safe homies, Nazis are about,” the employee, whose identity hasn’t been revealed publicly, wrote in an internal Slack chat room on January 6. He was fired two days later, after one “coworker was quick to criticize the employee for using divisive rhetoric,” Business Insider reported last week.

“I did not know that, as a Jew, it would be so polarizing to say this word,” the former employee wrote in a Slack group for Jewish employees shortly “before his corporate accounts got deactivated,” Business Insider wrote. The former employee “is Jewish and had family who died in the Holocaust,” the article said.

The former employee told Business Insider that he sent the message in Slack because he “was scared for people who were there [in DC].” He also said that GitHub’s human resources cited unspecified “patterns of behavior” when firing him, and that he was seeking more details on the reason for his termination.

About 200 employees signed an internal letter protesting the firing, Business Insider wrote. GitHub employees have also been “saying ‘Nazi’ repeatedly in Slack in regards to the US Capitol rioters, to protest what is being perceived as unfair treatment,” according to The Verge.

GitHub’s apology

GitHub, which is owned by Microsoft, announced yesterday that it has “reversed the decision to separate with the employee and are in communication with his representative.” GitHub said the reversal came after it hired “an outside investigator to conduct an independent investigation.” That “investigation revealed significant errors of judgment and procedure,” and the company’s head of human resources “has taken personal accountability and resigned from GitHub,” GitHub COO Erica Brescia wrote. (TechCrunch identified that HR executive as Carrie Olesen.)

“To the employee we wish to say publicly: we sincerely apologize,” Brescia wrote.

We asked GitHub today if it has been able to hire the fired employee back and/or reach a settlement with him, and we’ll update this article if we get an answer.

GitHub also condemned the mob, saying, “It was appalling last week to watch a violent mob, including Nazis and white supremacists, attack the US Capitol.” Though GitHub apologized for firing the employee, the company also said that employees must be “respectful” and “professional” when discussing the topic and similar ones internally.

“Employees are free to express concerns about Nazis, antisemitism, white supremacy or any other form of discrimination or harassment in internal discussions,” GitHub said. “We expect all employees to be respectful, professional, and follow GitHub policies on discrimination and harassment.”

The fired employee spoke with TechCrunch last week before GitHub announced its decision to reverse the firing. The man “says he is currently seeking counsel to ensure his family is protected, as well as figure out if he can receive damages or some other form of reconciliation” and that he “is waiting to engage with the company until he has legal representation in place,” TechCrunch wrote.

The fired employee said he was also threatened with being fired in October when he complained about a lack of diversity in GitHub leadership. “I feel like this could be an opportunity for GitHub to really do a purge and say, ‘Do we want white supremacists at this company and how do we get Black leaders into executive management?” he told TechCrunch.

Correction: This article originally misidentified GitHub’s now-former head of human resources.

https://arstechnica.com/?p=1735821

In October 2019, Idaho proposed changing its Medicaid program. The state needed approval from the federal government, which solicited public feedback via Medicaid.gov.

Roughly 1,000 comments arrived. But half came not from concerned citizens or even Internet trolls. They were generated by artificial intelligence. And a study found that people could not distinguish the real comments from the fake ones.

The project was the work of Max Weiss, a tech-savvy medical student at Harvard, but it received little attention at the time. Now, with AI language systems advancing rapidly, some say the government and Internet companies need to rethink how they solicit and screen feedback to guard against deepfake text manipulation and other AI-powered interference.

“The ease with which a bot can generate and submit relevant text that impersonates human speech on government websites is surprising and really important to know,” says Latanya Sweeney, a professor at Harvard’s Kennedy School who advised Weiss on how to run the experiment ethically.

Sweeney says the problems extend well beyond government services, but it is imperative that public agencies find a solution. “AI can drown speech from real humans,” she says. “Government websites have to change.”

The Centers for Medicare and Medicaid Services says it has added new safeguards to the public comment system in response to Weiss’ study, though it declines to discuss specifics. Weiss says he was contacted by the US General Services Administration, which is developing a new version of the federal government website for publishing regulations and comments, about ways to better protect it from fake comments.

Government systems have been the target of automated influence campaigns before. In 2017, researchers discovered that over a million comments submitted to the Federal Communications Commission regarding plans to roll back net neutrality rules had been auto-generated, with certain phrases copied and pasted into different messages.

“I was a bit shocked when I saw nothing more than a submit button standing in the way of your comment becoming a part of the public record.”

Weiss’ project highlights a more serious threat. There has been remarkable progress in applying AI to language over the past few years. When powerful machine-learning algorithms are fed huge amounts of training data—in the form of books and text scraped from the Web—they can produce programs capable of generating convincing text. Besides myriad useful applications, this raises the prospect that all sorts of Internet messages, comments, and posts could be faked easily and less detectably.

“As technology gets better,” Sweeney says, “human speech venues become subject to manipulation without human knowledge that it has happened.” Weiss was working at a health care consumer-advocacy organization in the summer of 2019 when he learned about the public feedback process required to make Medicaid changes. Knowing that these public comments had swayed previous efforts to change state Medicaid programs, Weiss looked for tools that could auto-generate comments.

“I was a bit shocked when I saw nothing more than a submit button standing in the way of your comment becoming a part of the public record,” he says.

Weiss discovered GPT-2, a program released earlier that year by OpenAI, an AI company in San Francisco, and realized he could generate fake comments to simulate a groundswell of public opinion. “I was also shocked at how easy it was to fine tune GPT-2 to actually spit out the comments,” Weiss says. “It’s relatively concerning on a number of fronts.”

Besides the comment-generating tool, Weiss built software for automatically submitting comments. He also conducted an experiment in which volunteers were asked to distinguish between the AI-generated comments and ones written by humans. The volunteers did no better than random guessing.

After submitting the comments, Weiss notified the Centers for Medicare and Medicaid Services. He had added a few characters to make it easy to identify each fake comment. Even so, he says, the AI feedback remained posted online for several months.

GPT-3

OpenAI released a more capable version of its text-generation program, called GPT-3, last June. So far, it has only been made available to a few AI researchers and companies, with some people building useful applications such as programs that generate email messages from bullet points. When GPT-3 was released, OpenAI said in a research paper that it had not seen signs of GPT-2 being used maliciously, even though it had been aware of Weiss’ research.

OpenAI and other researchers have released a few tools capable of identifying AI-generated text. These use similar AI algorithms to spot telltale signs in the text. It’s not clear if anyone is using these to protect online commenting platforms. Facebook declined to say if it is using such tools; Google and Twitter did not respond to requests for comment.

It also isn’t clear if sophisticated AI tools are yet being used to create fake content. In August, researchers at Google posted details of an experiment that used deepfake-text-detection tools to analyze over 500 million webpages. They found that the tools could identify pages hosting auto-generated text and spam. But it wasn’t clear if any of the content was made using an AI tool such as GPT-2.

Renée DiResta, research manager at the Stanford Internet Observatory, which tracks online abuse, says she expects more government sites to be targeted by fake text. “Any time you have new technology, it’s a tool in the hands of some and a weapon in the hands of others,” she says.

Politically driven misinformation has become a critical issue in American politics. Joan Donovan, research director of the Shorenstein Center on Media, Politics and Public Policy at the Harvard Kennedy School, warns that sophisticated AI may not be needed to erode people’s sense of what’s true. “People’s emotions are frayed, and that makes them very vulnerable to convenient explanations rather than difficult truths,” Donovan says.

This story originally appeared on wired.com.

https://arstechnica.com/?p=1735534

On January 9—three days after supporters of President Trump started a riot at the US Capitol—Sean Evans decided it was time for action. Evans had seen a post on Nextdoor about neighbors running into hostile Trump supporters the night of the riot, leading to a verbal altercation that had left residents of his corner of Northwest DC on edge. Now, rumors flew online that the upcoming inauguration of President-elect Joe Biden would bring more protesters and more armed violence to the streets of his city. “I don’t want them in my neighborhood,” Evans thought to himself. In fact, he didn’t want insurrectionists in the city at all.

So on Nextdoor, Evans asked his neighbors to stop renting out their properties via Airbnb and VRBO. A few hours later, another neighbor devised a hashtag: #DontRentDC.

Separately, a group called ShutDownDC gathered 500 volunteers to message DC area Airbnb hosts. The group sent messages to the managers of 3,400 properties in the region—polite ones, according to ShutDownDC organizer Alex Dodd. The messages alerted the Airbnb hosts to an upcoming threat and asked them to please refrain from booking anyone in their homes in the days surrounding the inauguration.

It worked. On Wednesday, Airbnb said it would cancel and block all Washington area reservations next week. Guests who had booked reservations would be refunded; if hosts had reservations or had canceled them recently, they would be reimbursed for the lost income. Airbnb spokesperson Ben Breit said the company “came to this decision following dialog with Washington, DC, officials, the Metro police department, and members of Congress.” (Earlier in the week, DC’s mayor had asked people not to travel to the inauguration; many customary inaugural events will happen online.)

For Airbnb, the incident is a reminder that all its politics is local. The company, now publicly traded with a value of more than $100 billion, has made its reputation on selling visitors on neighborhood authenticity. But its business model has at times made it a lightning rod for local affairs and left it scrambling to solve social ills. Airbnb has battled with local governments to allow short-term rentals in residential neighborhoods. It has tussled with local officials over taxes and data sharing. It has reshaped the economies of tiny vacation towns. It has tried to prevent big parties in rentals, which have sometimes led to violence. More recently, it has met with the ire of neighbors who don’t want virus-stricken out-of-towners filling up their overloaded ICUs.

In DC this month, residents first tried to respond to insurrectionist violence themselves. Evans, the NextDoor organizer, believed it was easier that way. “I thought it would probably be more difficult for me to get Airbnb management to look at any email we sent them. So I thought, ‘Let’s try to do this from the ground up and contact neighbors within our vicinity.’” Most property owners he contacted were nice about it, he says. Some didn’t know about the security threats surrounding the inauguration. Others asked, Why don’t you get in touch with Airbnb about this?

On the other side of the equation, some Airbnb hosts were frustrated by the company’s inaction in the days immediately following the insurrection. They had received messages from neighbors; they wanted to help. But they also didn’t want to lose income during a recession. On Monday, Airbnb released a Capitol Safety Plan outlining additional reviews and booking requirements for guests in the DC area. Beyond that, renters were left to decide about letting out their properties themselves.

One Airbnb host, who asked not to be identified, has been renting the top floors of his home through Airbnb for a year. (DC regulations require homeowners to live on the property of their short-term rentals, though hosts say those rules often are ignored.) Right before Christmas, he approved a reservation for a group to stay in his apartment for what the renter called a “history sightseeing trip.” On the morning of January 6, he noticed the group filing out the front door in Trump gear. When he saw what was happening at the Capitol, he was freaked out. He called the Airbnb emergency support line to seek advice, and the service agent promised to call him back. He left for a friend’s because he didn’t feel comfortable sticking around to find out who or what the renters would bring back.

Then, a 2021 twist: as the renters returned to his house ahead of the city’s emergency 6pm curfew, they gathered on the porch, activating the man’s Ring camera. “I stormed the Capitol!” he could hear them brag to each other. Airbnb support didn’t call back.

“Each host was basically on their own,” the host says. After a potential renter canceled for inauguration week, he decided to pull the dates from Airbnb himself. Breit, the Airbnb spokesperson, says the company “apologizes that this case was not urgently escalated as it should have been when [the host] contacted our Community Support team.” The host sent the Ring footage to the FBI, and Airbnb says the renter has been suspended pending an investigation.

This story originally appeared on wired.com.

https://arstechnica.com/?p=1735519

Last month, the makers of one of the most promising coronavirus vaccines reported that hackers stole confidential documents they had submitted to a European Union regulatory body. On Friday, word emerged that the hackers have falsified some of the submissions’ contents and published them on the Internet.

Studies of the BNT162b2 vaccine jointly developed by pharmaceutical companies Pfizer and BioNTech found it’s 95 percent effective at preventing COVID-19 and is consistently effective across age, gender, race, and ethnicity demographics. Despite near-universal consensus among scientists that the vaccine is safe, some critics have worried it isn’t. The hackers appear to be trying to stoke those unsupported worries.

Data unlawfully accessed by the hackers “included internal/confidential email correspondence dating from November, relating to evaluation processes for COVID-19 vaccines,” the European Medicines Agency based in Amsterdam said in a statement. “Some of the correspondence has been manipulated by the perpetrators prior to publication in a way which could undermine trust in vaccines.”

Friday’s statement didn’t say where the documents were posted or how they were falsified. An EMA spokeswoman said in an email that: “We have seen that some of the correspondence has been published not in its integrity and original form and/or with comments or additions by the perpetrators.” She declined to elaborate. Pfizer officials declined to comment. BioNTech representatives couldn’t immediately be reached.

According to sleuthing by Empoli, Italy-based security company Yarix, more than 33 megabytes of data from the EMA hack were posted to a well-known forum on the dark Web site in late December. The dark Web post, titled “Astonishing fraud! Evil Pfffizer! Fake vaccines!” included a link to a forum on a Russian-language website.

“There are no certain elements that allow to confirm that the data recovered is only a part of the Leak or if it actually includes all the data stolen in the breach,” the Yarix post, which was published Monday, read after being run through Google Translate. “On the other hand, the intention behind the leak by cybercriminals is certain: that of causing significant damage to the reputation and credibility of EMA and Pfizer.”

Confidential COVID-19 vaccine data has been a hot commodity for hackers since the start of the pandemic. The EMA’s disclosure is among the first—if not the first—times accessed vaccine documents have been published.

https://arstechnica.com/?p=1735585

A neo-Nazi, white-supremacist robocaller who spread “xenophobic fearmongering” and “racist attacks on political candidates” has been ordered to pay a $9.9 million fine for violating the Truth in Caller ID Act, a US law that prohibits manipulation of caller ID numbers with the intent to defraud, cause harm, or wrongfully obtain anything of value. The Federal Communications Commission finalized the fine against Scott Rhodes of Idaho yesterday, nearly one year after the FCC first proposed the penalty.

“This individual made thousands of spoofed robocalls targeting specific communities with harmful pre-recorded messages,” the FCC said in an announcement. “The robocalls included xenophobic fearmongering (including to a victim’s family), racist attacks on political candidates, an apparent attempt to influence the jury in a domestic terrorism case, and threatening language toward a local journalist. The caller used an online calling platform to intentionally manipulate caller ID information so that the calls he was making appeared to come from local numbers—a technique called ‘neighbor spoofing.'”

Rhodes made “4,959 unlawful spoofed robocalls between May 2018 and December 2018,” with several different calling sprees that “targeted voters in districts during political campaigns or residents in communities that had experienced major news events relating to or involving public controversies,” the FCC’s forfeiture order said.

“I is the negro Andrew Gillum”

For example, Rhodes in November 2018 “launched a campaign targeting Georgia gubernatorial candidate Stacey Abrams,” with 583 robocalls that “purported to be from Oprah Winfrey, who was in Georgia campaigning with Ms. Abrams,” the FCC said in the forfeiture order. The FCC order pointed to a CNN article from the time, which said, “The group behind the robocall is The Road to Power, a white supremacist and anti-Semitic video podcast hosted by Scott Rhodes of Idaho.” The robocall contained “racist and anti-Semitic rhetoric,” CNN wrote.

Another Rhodes campaign targeted Andrew Gillum, who was running for governor in Florida. “Well hello there. I is the negro Andrew Gillum, and I be asking you to make me governor of this here state of Florida,” the robocalls said, “with a man speaking in a caricature of a Black dialect,” CNN wrote at the time.

Rhodes was “motivated by an intent to cause harm to these communities and gain media notoriety and publicity for his website and personal brand,” the FCC said. Rhodes’ various robocall campaigns directed recipients to visit “theroadtopower.com.” A November 2018 article by the Anti-Defamation League described the site as “a white supremacist and anti-Semitic broadcasting outlet,” and the piece said that Rhodes had “achieved local notoriety in late 2017 when police linked him to the distribution of white supremacist propaganda at Sandpoint (Idaho) High School, harassment of a Sandpoint resident, and threatening, anti-Semitic calls that included recordings of Hitler.”

The FCC summarized Rhodes’ other robocall campaigns as follows:

In Iowa, he spoofed a local number to robocall residents of the town of Brooklyn and surrounding areas with xenophobic messages referring to the arrest of an illegal alien for the murder of a local college student. In Idaho, he robocalled residents of the city of Sandpoint, attacking the local newspaper and its publisher after they reported the identity of the caller. In Virginia, he made spoofed robocalls to residents of Charlottesville based on a false conspiracy theory in an apparent attempt to influence the jury in the murder trial of James Fields, prompting the judge to explicitly instruct the jury pool to ignore the calls.

Fine reduced from $12.9 million

The FCC determined that Rhodes’ calls violated the Truth in Caller ID Act because he “intended to cause harm” and to “wrongfully obtain something of value,” namely “exposure for his website and personal brand, ‘The Road to Power.'” FCC-cited evidence that Rhodes intended to cause harm included a robocall made to the family of Mollie Tibbetts, the college student who was murdered—Tibbetts’ family spoke out against the use of her murder in debate over immigration laws.

The FCC originally proposed a $12.9 million fine against Rhodes, who was given a chance to respond as is standard practice in cases of proposed fines. “The Commission found most of his arguments unpersuasive but did reduce the forfeiture amount based on evidence that one of the many phone numbers used in the robocalls—used during a California primary campaign—was in fact the caller’s number to use,” the FCC said.

Rhodes argued that the caller ID numbers he used “conveyed a political message and therefore were protected by the First Amendment,” the FCC said. “The last four digits of his selected caller IDs were either ‘1488’ or ‘0420,’ which Rhodes alleges are neo-Nazi symbols.” A footnote in the FCC order explained that “The number ‘1488’ is an amalgamation of the ’14 Words,’ a white supremacist slogan, and ’88,’ which stands for ‘Heil Hitler.'” Rhodes claimed that 0420 is a reference to Hitler because he was born on April 20.

The FCC determined that using those digits did not give Rhodes’ robocalls protection under the First Amendment. Even if Rhodes intended the digits to convey a message, which the FCC doubted, “there is no evidence in the record that the called parties understood that message.” The FCC continued:

The fact that particular numbers may be intended to convey a political message does not afford a caller the right to use the numbers in violation of the Truth in Caller ID Act. The Truth in Caller ID Act bars the knowing transmission of inaccurate or misleading caller ID information with the intent to defraud, cause harm, or wrongfully obtain anything of value. If Rhodes wanted to use telephone numbers to try to convey a message, he would have needed to obtain the right to use the numbers. Moreover, Rhodes’s contention regarding the last four digits of the caller ID numbers does not alter the fact that he chose the first three digits—and in many cases the first six digits—to appear to be a local number, in order to: (1) hide his identity and (2) make it more likely that a called party would answer the phone thinking that it was a local caller. In any event, we find that there was no message in the spoofing here that was comprehensible to called parties; instead, the spoofing was non-expressive conduct and thus can be regulated.

The public version of the forfeiture order redacted the name of the calling service that Rhodes used, but said the service operator told the FCC that “it did not provide the caller IDs for the robocalls that came from Rhodes’s account. The calling party [Rhodes] thus had to have selected the caller IDs.”

The FCC has a poor track record collecting fines against robocallers, partly because proposed fines often don’t lead to forfeiture orders. In Rhodes’ case, yesterday’s forfeiture order requires him to pay the fine within 30 days. If he doesn’t, the FCC said it “will refer the matter to the US Department of Justice for further action.”

Issuing the forfeiture order was one of FCC Chairman Ajit Pai’s final acts before he leaves the commission next week. “With today’s fine, we once again make clear our commitment to aggressively go after those who are unlawfully bombarding the American people with spoofed robocalls,” Pai said yesterday.

https://arstechnica.com/?p=1735477