Millions of Facebook users in Illinois will be receiving about $340 each as Facebook settles a case alleging it broke state law when it collected facial recognition data on users without their consent. The judge hearing the case in federal court in California approved the final settlement on Thursday, six years after legal proceedings began.

“This is money that’s coming directly out of Facebook’s own pocket,” US District Judge James Donato said, according to the Chicago Tribune. “The violations here did not extract a penny from the pockets of the victims. But this is real money that Facebook is paying to compensate them for the tangible privacy harms that they suffered.”

Three different Illinois residents filed suit against Facebook in 2015 and claimed that the service’s “tag suggestions” feature, which uses facial recognition to suggest other users to tag in photos, violated their rights under the Illinois Biometric Information Privacy Act (BIPA). The suits were eventually rolled together into a single class-action complaint and transferred to federal court in California.

Illinois adopted BIPA in 2008, and it remains one of the strongest biometric data laws in the country. The statute requires any entity that gathers biometric data—including fingerprints, voice prints, “hand or face geometry,” and retinal or iris scans—to get informed consent from those individuals whose data it collects. Those entities are also required to protect biometric data they store in the same way they would have to protect other sensitive personally identifiable information.

The plaintiffs in the case argued that Facebook violated that law when it introduced the “tag suggestions” feature without gaining express consent from users. There are about 7 million total affected Facebook users in Illinois, and the statute stipulates penalties of $1,000 for each accidental violation or $5,000 for each knowing violation of the law, so Facebook could have been on the hook for as much as $35 billion if the case had gone to trial and the company lost.

Facebook tried to settle for $550 million in June 2020, but Judge Donato rejected that deal, finding it to be insufficient. The following month, he agreed to a preliminary sign off on a modified $650 million settlement, which he approved the final version of in this week’s hearing.

The legal firms representing the plaintiffs asked to get about $110 million of the settlement money. That leaves the remaining $540 million to be divided among the roughly 1.6 million members of the class who filed a claim before the Nov. 23 deadline, which works out to about $338 per user. Those payments are expected to take “a few months” to make their way to claimants.

Controversial facial recognition firm Clearview AI is also facing a class action BIPA suit in Illinois amid allegations that it collected billions of facial images for matching without the consent or knowledge of either the people in the photos or the services from which the images were scraped.

Although $340 per person is far less than the $1,000 or $5,000 per person Facebook could theoretically have been made to pay, it’s still an unusually high payout for members of a class action suit, which in many cases provide a pittance to affected individuals. The lawsuits against Equifax over its massive 2017 data breach, for example, will probably result in pocket change at best for the 147 million consumers who had their personal data purloined.

https://arstechnica.com/?p=1735391

Former Michigan Governor Rick Snyder and eight other officials have been indicted on criminal charges related to their handling of the Flint water crisis. Snyder was charged with two counts of willful neglect of duty, which are misdemeanor charges that can each be punished by up to a year in prison and a $1,000 fine.

“When an entire city is victimized by the negligence and indifference of those in power, it deserves an uncompromising investigation that holds to account anyone who is criminally culpable,” Michigan Solicitor General Fadwa Hammoud said at a press conference today. “We must remember that the Flint water crisis is not some relic of the past. At this very moment, the people of Flint continue to suffer from the categorical failure of public officials at all levels of government, who trampled upon their trust and evaded accountability for far too long.”

The charges against Snyder are “for willfully neglecting his mandatory legal duties under the Michigan Constitution and Emergency Management Act, thereby failing to protect the health and safety of Flint’s residents,” Hammoud said.

“Nobody, no matter how powerful or well-connected, is above accountability when they commit a crime,” she also said, adding that “we may never know all the names of those who had their lives and livelihoods destroyed by this man-made crisis.”

Officials said they could not comment on any of the evidence supporting the indictments today because of state law prohibiting sharing of testimony, evidence, and information used in connection with a grand jury probe. Evidence would be presented publicly later in court proceedings.

Snyder pleads not guilty

Snyder, 62, pleaded not guilty via Zoom in an arraignment in the 67th District Court of Genesee County today. He served as governor from 2011 to 2019 and was prevented from seeking a third term because of term limits.

“Three Michigan attorneys who practice criminal law said the misdemeanor charges against Snyder are a surprise and that the length of time that has lapsed could make getting any conviction against Snyder a challenge,” the Detroit Free Press wrote yesterday. “But all three said that even securing a misdemeanor conviction could allow a judge to issue a significant restitution order against Snyder, a multi-millionaire who made a fortune in computers and venture capital before he was elected Michigan governor in 2010.”

“In not bringing a felony charge, ‘restitution would be the objective,’ [St. Clair Shores attorney Craig] Tank said,” according to the Free Press. “‘Everyone in the state of Michigan recognizes that the man has deep pockets.'”

Snyder’s attorney, Brian Lennon, said that a criminal case would be “outrageous” and that “we believe there is no evidence to support any criminal charges against Gov. Snyder,” the Associated Press reported.

The Flint water crisis began in 2014 “when the city switched its drinking water supply from Detroit’s system to the Flint River in a cost-saving move,” as noted by the Natural Resources Defense Council. “Inadequate treatment and testing of the water resulted in a series of major water quality and health issues for Flint residents—issues that were chronically ignored, overlooked, and discounted by government officials even as complaints mounted that the foul-smelling, discolored, and off-tasting water piped into Flint homes for 18 months was causing skin rashes, hair loss, and itchy skin.”

Eight more defendants

All nine defendants and their charges are listed in this announcement by the Michigan attorney general’s office. Links to the indictment documents are available here. The indictments came from “a one-man grand jury” consisting of Circuit Court Judge David Newblatt, the announcement said.

Besides Snyder, the defendants are as follows:

• Jarrod Agen, former director of communications and chief of staff for Snyder, was charged with one count of perjury, a felony that can be punished with a 15-year prison sentence. (Agen is currently a spokesperson for Lockheed Martin and also formerly served as director of communications and deputy chief of staff for Vice President Mike Pence.)
• Gerald Ambrose, former Flint Emergency Manager, was charged with four counts of misconduct in office, each a five-year felony and/or a $10,000 fine.
• Richard Baird, former transformation manager and senior adviser for Snyder, was charged with one count of perjury (a 15-year felony), one count of official misconduct in office (a five-year felony and/or $10,000 fine), one count of obstruction of justice (a five-year felony and/or $10,000 fine), and one count of extortion (a 20-year felony and/or $10,000 fine).
• Howard Croft, former Director of the Flint Department of Public Works, was charged with two counts of willful neglect of duty, misdemeanors that can be punished by one year in prison and/or a $1,000 fine.
• Darnell Earley, former Flint emergency manager, was charged with three counts of misconduct in office, each a five-year felony and/or $10,000 fine.
• Nicolas Lyon, former director of the Michigan Department of Health and Human Services, was charged with nine counts of involuntary manslaughter, each a 15-year felony and/or $7,500 fine. Lyon was also charged with one count of willful neglect of duty, a one-year misdemeanor and/or $1,000 fine.
• Nancy Peeler, the current Early Childhood Health Section Manager for the Michigan Department of Health and Human Services, was charged with two counts of misconduct in office, each a five-year felony and/or $10,000 fine; and one count of willful neglect of duty, a one-year misdemeanor and/or $1,000 fine.
• Eden Wells, former Chief Medical Executive of the Michigan Department of Health and Human Services, was charged with nine counts of involuntary manslaughter, each a 15-year felony and/or $7,500 fine; two counts of misconduct in office, each a five-year felony and/or $10,000 fine; and one count of willful neglect of duty, a one-year misdemeanor and/or $1,000 fine.

“Our approach was simple—where we believed the evidence would prove a criminal charge, we sought and obtained indictments for those crimes,” Hammoud said.

Obstruction of justice

Though evidence was not presented publicly, Hammoud elaborated slightly on the charges in the press conference. For example, Baird’s charge of obstruction of justice was “for attempting to interfere or influence ongoing legal proceedings related to the Flint water crisis,” and his extortion charge was “for threatening a state-appointed research team during their investigation into the source of the Legionnaires’ disease outbreak in Genesee County,” she said.

The misconduct charges against Wells were for “two separate incidents of preventing or attempting to prevent the distribution of public health information about Legionnaires’ disease in Genesee County,” Hammoud said. Peeler’s charges related to “concealing and later misrepresenting data related to elevated blood lead levels of children in Flint,” and “failure to act upon information of those elevated blood levels,” she said.

Earley was charged “for acts related to Flint’s finances and misinformation about the quality and safety of the Flint water supply,” she said. Croft was charged “for willfully neglecting his duty to ensure the safety and quality of Flint’s water supply,” she said. Lyon was charged for his “grossly negligent performance of his legal duties” to protect the health of residents, she said.

All nine defendants turned themselves into Genesee County Jail and were arraigned, Hammoud said. Snyder and Croft’s next scheduled court date is January 19, and the other defendants’ next scheduled court date is February 18, she said.

https://arstechnica.com/?p=1735171

Amazon on Tuesday brought receipts in its response to seemingly defunct social networking platform Parler’s lawsuit against it, detailing AWS’ repeated efforts to get Parler to address explicit threats of violence posted to the service.

In the wake of the violent insurrection at the US Capitol last Wednesday, AWS kicked Parler off its Web-hosting platform at midnight Sunday evening. In response, Parler filed a lawsuit accusing Amazon of breaking a contract for political reasons and colluding with Twitter to drive a competitor offline.

But the ban has nothing to do with “stifling viewpoints” or a “conspiracy” to restrain a competitor, Amazon said in its response filing (PDF). Instead, Amazon said, “This case is about Parler’s demonstrated unwillingness and inability” to remove actively dangerous content, including posts that incite and plan “the rape, torture, and assassination of named public officials and private citizens… AWS suspended Parler’s account as a last resort to prevent further access to such content, including plans for violence to disrupt the impending Presidential transition.”

“If there is any breach, it is Parler’s demonstrated failure and inability to identify and remove such content,” Amazon added. “Compelling AWS to host content that plans, encourages, and incites violence would be unprecedented.”

Not sudden at all

To an outside observer, both Parler’s rapid rise to prominence and its thorough deplatforming at the end of last week and over the weekend may have felt extremely sudden. Parler launched in 2018 but only gained any real widespread traction a few months ago, around the November election.

Reports first began to surface in December that right-wing fringe elements were using Parler and other platforms to plan a protest or gathering of some kind in Washington, DC, on January 6. The entire world saw how those “gatherings” turned out last week.

Last Friday, in the wake of the events at the Capitol, Google banned Parler from the Android app store, citing the platform’s failure to remove “egregious content like posts that incite violence.” Apple followed a day later, similarly suspending Parler from iOS over its failure to address “the proliferation of these threats to people’s safety.” By the end of the weekend, Parler had gotten the boot from AWS as well and was taken completely offline.

But far from getting cut off suddenly, Parler had months of warning, Amazon says. Amazon’s filing included copies of emails it sent to Parler in mid-November (PDF, content warning for racial slurs) containing screenshots full of racist invective about Democrats, including former First Lady Michelle Obama, with a series of responses from other users to “kill ‘em all.”

Amazon provided “more than 100 additional representative pieces of content” advocating violence on Parler over the following seven weeks, the company said. Another document in the filing (PDF, also with content warning for racial slurs and threats of violence) lays out dozens of examples of posts Amazon reported to Parler, beginning in mid-December. Those posts call for, among other things: killing a specific transgender person; actively wishing for a race war and the murder of Black and Jewish people; and killing several activists and politicians such as Stacey Abrams, Rep. Alexandria Ocasio-Cortez (D-N.Y.), and former President Barack Obama.

Representatives from AWS spoke with Parler executive leadership on both January 8 and 9 about the platform’s “content moderation policies, processes, and tools,” Amazon said. In response, Parler allegedly offered steps that would rely on “volunteer” moderation, and Parler CEO John Matze allegedly told AWS that “Parler had a backlog of 26,000 reports of content that violated its community standards and remained on its service.”

Legitimate concerns

Violent threats made by at least some Parler users have unfortunately proven to be far from hypothetical.

Nearly all of Parler’s content was archived before the service went completely offline. Gizmodo reporters digging into that archived data were able to find several hundred Parler users who were posting video to the platform from in or near the Capitol during the events of January 6.

Ad-hoc efforts on Reddit and Twitter to gather screenshots and video from Parler also show a disturbing pattern of threats and claims made on the platform in the days both before and after the January 6 insurrection.

As The Washington Post reported Tuesday, the FBI was also well aware of credible threats of violence being made online. On January 5, the day before rioters stormed the Capitol, an FBI office in Norfolk, Virginia, issued a memo reading in part, “An online thread discussed specific calls for violence to include stating ‘Be ready to fight. Congress needs to hear glass breaking, doors being kicked in, and blood from their BLM and Pantifa slave soldiers being spilled. Get violent. Stop calling this a march, or rally, or a protest. Go there ready for war. We get our President or we die. NOTHING else will achieve this goal.'”

Neither have the threats of violence abated, unfortunately. The District of Columbia is slowly turning into a fortress ahead of President-elect Joe Biden’s inauguration next week, as credible threats of violence continue to target not only the nation’s capital, but also state capitals as well.

https://arstechnica.com/?p=1734842

Republican state lawmakers in North Dakota want Facebook and Twitter to face lawsuits from users who have been “censored.”

A bill submitted by the six legislators last week is titled, “an Act to permit civil actions against social media sites for censoring speech.” It says that social media websites with over 1 million users would be “liable in a civil action for damages to the person whose speech is restricted, censored, or suppressed, and to any person who reasonably otherwise would have received the writing, speech, or publication.” Payouts for “censored” users would include “treble damages for compensatory, consequential, and incidental damages.”

Even if passed by the North Dakota legislature, the bill would likely have no effect due to a conflict with federal law. The proposed law “would immediately be deemed void as preempted by Section 230 [of the Communications Decency Act],” because “federal law is supreme over state law where they conflict, and this would create an express conflict,” attorney Akiva Cohen wrote in a Twitter thread about the bill.

Section 230 is a US law enacted in 1996 that says providers and users of interactive computer services shall not be held liable for “any action voluntarily taken in good faith to restrict access to or availability of material that the provider or user considers to be obscene, lewd, lascivious, filthy, excessively violent, harassing, or otherwise objectionable, whether or not such material is constitutionally protected.”

The law thus gives legal protection to companies that moderate user-generated content on the online platforms they operate. The law has been a major topic of controversy recently, particularly among Republicans, with President Trump demanding that social media companies be stripped of their legal immunity.

The North Dakota bill’s lead sponsor is Republican Rep. Tom Kading, who is angry that Facebook and Twitter banned Trump after he incited the insurrectionist riot at the US Capitol.

“Lead bill sponsor Rep. Tom Kading said, ‘It’s just wrong to ban a sitting president,’ but he noted his proposal is meant to provide a legal tool only for those who live in North Dakota,” the Grand Forks Herald wrote yesterday.

Bill oddities

Curiously, the North Dakota bill text says it would apply only in cases when the company “is immune from civil liability under federal law.” That seems to mean that the proposed North Dakota law would no longer apply if Section 230 is repealed by the federal government—but the proposed law likely can’t be enforced while Section 230 is in place, either.

“There’s no question that this would target conduct immune under federal law—and, in fact, if [Section] 230 were repealed nobody could ever be liable under this law (since it only reaches immune conduct),” Cohen wrote. In other words, the North Dakota bill is “incredibly stupid,” he wrote.

Even if the North Dakota bill can be implemented, determining exactly when a provider could be sued for damages would difficult. Despite attempting to make providers liable for “censorship,” the bill text says providers can block posts that are “obscene, lewd, lascivious, filthy, excessively violent, harassing, or otherwise objectionable subject matter.” Blocking anything that doesn’t fit into those categories would be considered “censorship” under this proposal, but standards like “excessively violent” and “otherwise objectionable” are vague.

“We’ll protect you”

“There’s a pretty obvious First Amendment problem with the government saying ‘we’ll protect you from being sued if you ban content we want you to ban, but not different substantive content we like,'” Cohen wrote. “That’s the definition of a law regulating speech that turns on the substance of the speech in question, so there can’t be any government standard for defining ‘otherwise objectionable.'”

Additionally, the bill provision allowing lawsuits from people who didn’t get to see blocked content is “an unfathomably bad idea,” Cohen wrote. “If Twitter banned me, all 19K of my followers would have the ability to separately sue Twitter for damages for being deprived of my pearls of wisdom and gif game?”

Beyond this particular bill, Cohen argued that “legislating around [Section] 230 at the state level is doomed.”

https://arstechnica.com/?p=1734648

Facebook executive leaders promise they are doing everything they can to prevent the platform from being a tool for an anticipated new wave of violence in the nation’s capital in the upcoming days. At the same time, however, content threatening violence is still up on Facebook, and those same executives are downplaying how big a role the platform had in last week’s events at the US Capitol.

Facebook COO Sheryl Sandberg gave a livestreamed interview with Reuters Monday in which she said President Donald Trump is not likely to get his Facebook account reinstated following the company’s “indefinite” ban.

“Even the president is not above the polices we have,” Sandberg said. “We have no plans to let him [back] in.”

But even though she reiterated that the president was banned specifically for fomenting violence on the platform, Sandberg downplayed the role Facebook may have had in bringing the mob to the Capitol in the first place.

“We know this was organized online,” Sandberg told Reuters. “We took down QAnon, Proud Boys, Stop the Steal—anything that was talking about possible violence last week. Our enforcement’s never perfect, so I’m sure there were still things on Facebook, [but] I think these events were largely organized on platforms that don’t have our abilities to stop hate and don’t have our standards and don’t have our transparency.”

Still, she added, “Certainly, to this day, we are working to find any single mention that might be linked to this and making sure we get it down as quickly as possible.”

It is true that a great deal of planning the various groups and individuals did last week took place on less-mainstream communication platforms, such as Parler, Telegram, Gab, 4chan, and dedicated pro-Trump forums. However, the insurrectionists responsible for the attack were not exclusively on those platforms—and the mainstream political figures who egged them on were explicitly present on mainstream platforms, including Twitter and Facebook.

Facebook clearly knows it has a problem with violent users and content; otherwise, the platform wouldn’t have needed to take the actions it has taken this week.

The scramble

Chief among those supporters of the mob was Trump himself, as Facebook CEO Mark Zuckerberg acknowledged last week when Facebook deleted a few of Trump’s posts and suspended his account.

Trump’s decision to use Facebook “to condone rather than condemn the actions of his supporters at the Capitol building has rightly disturbed people in the US and around the world,” Zuckerberg said at the time. “We removed these statements yesterday because we judged that their effect—and likely their intent—would be to provoke further violence.”

Facebook is also apparently quietly concerned that violence may spill over into retaliation against company employees. Facebook’s security team this week told workers to “avoid wearing or carrying Facebook-branded items at this time.” The Information was first to report on the message, which was seemingly aimed at reducing the chance of Facebook employees becoming targets.

As part of its “preparations” for Inauguration Day, Facebook on Monday said it would ban the phrase “stop the steal,” a rallying cry used by those who don’t (or don’t want to) believe in the fact that President-elect Joe Biden won the election (a group that includes President Trump).

The company added:

We’ve had emergency measures in place since before the US elections such as not recommending civic groups for people to join. Last week, we implemented several additional ones, including increasing the requirement of Group admins to review and approve posts before they can go up, automatically disabling comments on posts in Groups that start to have a high rate of hate speech or content that incites violence, and using AI to further demote content that likely violates our policies. We’re keeping these measures in place.

“Any single mention”

Facebook, however, is clearly failing to go after “any single mention” of statements that could provoke or contribute to further violence, despite its increased efforts.

A cursory search of Facebook “events” in and near Washington, DC, next week brought up several gatherings and demonstrations that seem designed to interfere with Biden’s inauguration. Some are planned over the weekend, in the days ahead of the event, while others call for participants to gather at the Capitol on January 20—Inauguration Day itself.

The same quick, cursory, five-minute search also brought up a half-dozen private groups that say they plan to bring together “patriots” to march on Washington during the week of the Inauguration, as well as one public group where members were posting threatening content such as a picture of House Speaker Nancy Pelosi (D-Calif.), with the text, “WHY can’t ‘someone’ shut this POS’s mouth??? … SHE ABSOLUTELY NEEDS TO BE LEAD [sic] OUT TO PASTURE.”

Neither is Facebook’s block on “stop the steal” working terribly well as of yet, as Ars’ own Timothy Lee has discovered.

In the meantime, the District of Columbia is already shutting down for blocks around the Capitol, and heavy law enforcement and street closures are expected to remain in place through January 24.

https://arstechnica.com/?p=1734401

The malware used to hack Microsoft, security company FireEye, and at least a half-dozen federal agencies has “interesting similarities” to malicious software that has been circulating since at least 2015, researchers said on Monday.

Sunburst is the name security researchers have given to malware that infected about 18,000 organizations when they installed a malicious update for Orion, a network management tool sold by Austin, Texas-based SolarWinds. The unknown attackers who planted Sunburst in Orion used it to install additional malware that burrowed further into select networks of interest. With infections that hit the Departments of Justice, Commerce, Treasury, Energy, and Homeland Security, the hack campaign is among the worst in modern US history. The National Security Agency, the FBI, and two other federal agencies last week said that the Russian government was “likely” behind the attack, which began no later than October 2019. While several news sources, citing unnamed officials, have reported the intrusions were the work of the Kremlin’s SVR, or Foreign Intelligence Service, researchers continue to look for evidence that definitively proves or disproves the statements.

Kind of suspicious

On Monday, researchers from Moscow-based security company Kaspersky Lab reported “curious similarities” in the code of Sunburst and Kazuar, a piece of malware that first came to light in 2017. Kazuar, researchers from security firm Palo Alto Networks said then, was used alongside known tools from Turla, one of the world’s most advanced hacking groups, whose members speak fluent Russian.

In a report published on Monday, Kaspersky Labs researchers said they found at least three similarities in the code and functions of Sunburst and Kazuar. They are:

• The algorithm used to generate the unique victim identifiers
• The algorithm used to make the malware “sleep,” or delay taking action, after infecting a network, and
• Extensive use of the FNV-1a hashing algorithm to obfuscate code.

“It should be pointed [out] that none of these code fragments are 100% identical,” Kaspersky Lab researchers Gregory Kucherin, Igor Kuznetsov, and Costin Raiu wrote. “Nevertheless, they are curious coincidences, to say [the] least. One coincidence wouldn’t be that unusual, two coincidences would definitively raise an eyebrow, while three such coincidences are kind of suspicious to us.”

Monday’s post cautions against drawing too many inferences from the similarities. They could mean that Sunburst was written by the same developers behind Kazuar, but they might also be the result of an attempt to mislead investigators about the true origins of the SolarWinds supply chain attack, something researchers call a false flag operation.

Other possibilities include a developer who worked on Kazuar and later went to work for the group creating Sunburst, the Sunburst developers reverse engineering Kazuar and using it as inspiration, or developers of Kazuar and Sunburst obtaining their malware from the same source.

The Kaspersky Lab researchers wrote:

At the moment, we do not know which one of these options is true. While Kazuar and Sunburst may be related, the nature of this relation is still not clear. Through further analysis, it is possible that evidence confirming one or several of these points might arise. At the same time, it is also possible that the Sunburst developers were really good at their opsec and didn’t make any mistakes, with this link being an elaborate false flag. In any case, this overlap doesn’t change much for the defenders. Supply chain attacks are some of the most sophisticated types of attacks nowadays and have been successfully used in the past by APT groups such as Winnti/Barium/APT41 and various cybercriminal groups.

Federal officials and researchers have said that it could take months to understand the full impact of the months-long hacking campaign. Monday’s post called on other researchers to further analyze the similarities for additional clues about who is behind the attacks.

https://arstechnica.com/?p=1734211

The Republican lawmaker who was arrested for storming the US Capitol has resigned from the West Virginia State Legislature. “I hereby resign as a member of the West Virginia House of Delegates, effective immediately,” Derrick Evans wrote in a one-sentence letter to West Virginia Gov. Jim Justice on Saturday.

Evans also released a statement saying, “I take full responsibility for my actions, and deeply regret any hurt, pain or embarrassment I may have caused my family, friends, constituents and fellow West Virginians. I hope this action I take today can remove any cloud of distraction from the state Legislature, so my colleagues can get to work in earnest building a brighter future for our state.” Evans also wrote that he hopes his resignation will help “begin the healing process” for the United States.

Evans, who served in the state legislature for just one month before his resignation, was part of the Trump-incited insurrectionist mob that broke into the US Capitol on Wednesday last week in an attempt to stop certification of Joe Biden’s presidential election victory. Evans livestreamed himself on Facebook while chanting Trump’s name and yelling, “We’re in! We’re in! Derrick Evans is in the Capitol!” In another video he posted earlier in the day, he said that “people who are tired of liberals running this country and stealing elections” should “get off the couch and show up today in force and send a message.” The Trump-incited mob violence led to the death of a US Capitol police officer.

Evans, 35, initially refused to resign and claimed that he was acting as a member of the media. His resignation came one day after he was arrested by the FBI and charged with entering a restricted building without lawful authority and “violent entry and disorderly conduct on Capitol grounds.”

“FIGHT FOR TRUMP, JANUARY 6. We’re Comin!”

The US government filed a complaint against Evans in US District Court for the District of Columbia. An affidavit by FBI Special Agent David DiMarco said that Evans traveled to Washington, DC, where he “knowingly and willfully joined and encouraged a crowd of individuals who forcibly entered the US Capitol and impeded, disrupted, and disturbed the orderly conduct of business by the United States House of Representatives and the United States Senate.”

DiMarco’s affidavit said he identified Evans from his livestream video and compared the voice on that video with Evans’ voice from one of his campaign videos. “Evans identifies himself by first and last name during the recorded video capturing the offense,” DiMarco wrote, referring to the video Evans took of himself. DiMarco also described public posts on Evans’ Facebook page, calling them “potentially relevant to Evans’ motive and intent.”

“For instance, on December 28, 2020, Evans posted a meme, with a picture of President Donald J. Trump, and the text, ‘FIGHT FOR TRUMP, JANUARY 6. We’re Comin!'” DiMarco wrote. “Evans included the caption, ‘Anyone else going to DC on Jan 6th?'”

Two days later, Evans “posted another meme showing President Trump and the text, ‘TAKE AMERICA BACK. BE THERE. WILL BE WILD. DC, JANUARY 6, 2021,'” DiMarco wrote. More Evans posts leading up to the January 6 riot included text such as “A STORM IS COMING… AND THERE IS NOTHING THE LEFT CAN DO TO STOP IT!”

One day before the riot, “Evans posted a photo of Washington, DC, with the caption, ‘We have two charter buses leaving the local area in 3 hours. I can’t wait for tomorrow. #StopTheSteal,'” DiMarco wrote. Later that evening, Evans posted a photo of people inside one of the chartered buses. In the video Evans posted shortly before the mob entered the Capitol, he said, “They’re making an announcement right now saying if Pence betrays us you better get your mind right because we’re storming that building. I’m just the messenger, so don’t be hating on me. I’m just telling you what I’m hearing right now on the ground.”

Under US law, the charge of illegally entering a restricted building with the intent to disrupt government business can be punished by a fine and one year in prison, or up to 10 years in prison if the offender “uses or carries a deadly or dangerous weapon or firearm” when committing the offense. The FBI affidavit didn’t mention Evans carrying a weapon.

https://arstechnica.com/?p=1734193

In 1964, the Civil Rights Act barred the humans who made hiring decisions from discriminating on the basis of sex or race. Now, software often contributes to those hiring decisions, helping managers screen résumés or interpret video interviews.

That worries some tech experts and civil rights groups, who cite evidence that algorithms can replicate or magnify biases shown by people. In 2018, Reuters reported that Amazon scrapped a tool that filtered résumés based on past hiring patterns because it discriminated against women.

Legislation proposed in the New York City Council seeks to update hiring discrimination rules for the age of algorithms. The bill would require companies to disclose to candidates when they have been assessed with the help of software. Companies that sell such tools would have to perform annual audits to check that their people-sorting tech doesn’t discriminate.

The proposal is a part of a recent movement at all levels of government to place legal constraints on algorithms and software that shape life-changing decisions—one that may shift into new gear when Democrats take control of the White House and both houses of Congress.

More than a dozen US cities have banned government use of face recognition, and New York state recently passed a two-year moratorium on the technology’s use in schools. Some federal lawmakers have proposed legislation to regulate face algorithms and automated decision tools used by corporations, including for hiring. In December, 10 senators asked the Equal Employment Opportunity Commission to police bias in AI hiring tools, saying they feared the technology could deepen racial disparities in employment and hurt economic recovery from COVID-19 in marginalized communities. Also last year, a new law took effect in Illinois requiring consent before using video analysis on job candidates; a similar Maryland law restricts use of face analysis technology in hiring.

Lawmakers are more practiced in talking about regulating new algorithms and AI tools than implementing such rules. Months after San Francisco banned face recognition in 2019, it had to amend the ordinance because it inadvertently made city-owned iPhones illegal.

The New York City proposal launched by Democratic council member Laurie Cumbo would require companies using what are termed automated employment-decision tools to help screen candidates or decide terms such as compensation to disclose use of the technology. Vendors of such software would be required to conduct a “bias audit” of their products each year and make the results available to customers.

Strange bedfellows

The proposal faces resistance from some unusual allies, as well as unresolved questions about how it would operate. Eric Ellman, senior vice president for public policy at the Consumer Data Industry Association, which represents credit- and background-checking firms, says the bill could make hiring less fair by placing new burdens on companies that run background checks on behalf of employers. He argues that such checks can help managers overcome a reluctance to hire people from certain demographic groups.

Some civil rights groups and AI experts also oppose the bill—for different reasons. Albert Fox Cahn, founder of the Surveillance Technology Oversight Project, organized a letter from 12 groups including the NAACP and New York University’s AI Now Institute objecting to the proposed law. Cahn wants to regulate hiring tech, but he says the New York proposal could allow software that perpetuates discrimination to get rubber-stamped as having passed a fairness audit.

Cahn wants any law to define the technology covered more broadly, not let vendors decide how to audit their own technology, and allow individuals to sue to enforce the law. “We didn’t see any meaningful form of enforcement against the discrimination we’re concerned about,” he says.

Supporters

Others have concerns but still support the New York proposal. “I hope that the bill will go forward,” says Julia Stoyanovich, director of the Center for Responsible AI at New York University. “I also hope it will be revised.”

Like Cahn, Stoyanovich is concerned that the bill’s auditing requirement is not well defined. She still thinks it’s worth passing, in part because when she organized public meetings on hiring technology at Queens Public Library, many citizens were surprised to learn that automated tools were widely used. “The reason I’m in favor is that it will compel disclosure to people that they were evaluated in part by a machine as well as a human,” Stoyanovich says. “That will help get members of the public into the conversation.”

Two New York–based startups whose hiring tools would be regulated by the new rules say they welcome them. The founders of HiredScore, which tries to highlight promising candidates based on résumés and other data sources, and Pymetrics, which offers online assessments based on cognitive psychology with the help of machine learning, both supported the bill during a virtual hearing of the City Council’s Committee on Technology in November.

Frida Polli, Pymetrics’ CEO and cofounder, markets the company’s technology as providing a fairer signal about candidates than traditional measures like résumés, which she says can disadvantage people from less privileged backgrounds. The company recently had its technology audited for fairness by researchers from Northeastern University. She acknowledges that the bill’s auditing requirement could be tougher but says it’s unclear how to do that in a practical way, and it would be better to get something on the books. “The bill is moderate, but in a powerful way,” she says.

“Like the Wild West out there”

Robert Holden, chair of the City Council’s Committee on Technology, has his own concerns about the cash-strapped city government’s capacity to define how to scrutinize hiring software. He’s also been hearing from envoys from companies whose software would fall under the proposed rules, which have prompted more industry engagement than is usual for City Council business. Some have assured him the industry can be trusted to self-regulate. Holden says what he’s learned so far makes clear that more transparency is needed. “It’s almost like the Wild West out there now,” Holden says. “We really have to provide some transparency.”

Holden says the bill likely faces some negotiations and rewrites, as well as possible opposition from the mayor’s office, before it could be scheduled for a final vote by the council. If passed, it would take effect January 2022.

This story originally appeared on wired.com.

https://arstechnica.com/?p=1733895

Amazon Web Services is suspending Parler’s access to its hosting services at the end of the weekend, potentially driving the service offline unless it can find a new provider.

“Because Parler cannot comply with our terms of service and poses a very real risk to public safety, we plan to suspend Parler’s account effective Sunday, January 10th, at 11:59PM PST,” Amazon wrote to Parler in an email obtained and first reported by BuzzFeed.

The email from AWS to Parler cites several examples of violent and threatening posts made in recent days, including threats to “systematically assassinate liberal leaders, liberal activists, BLM leaders and supporters,” and others. “Given the unfortunate events that transpired this past week in Washington, D.C., there is serious risk that this type of content will further incite violence,” the message adds.

Parler launched in 2018 as a “free speech” alternative to Twitter and Facebook. Through 2019 and 2020, it drew a number of conservative, right-wing, and far-right fringe users. Usage has dramatically increased in the past few days in the wake of Wednesday’s events at the US Capitol and President Donald Trump’s subsequent total ban from Twitter and other platforms.

That increased traffic has also brought increased threats of violence to the platform, which technology companies across the board seem to be taking more seriously after this week—and no wonder, as the insurrectionists who attacked the Capitol made widespread use of social media to plan, carry out, and brag about their activity.

Parler, however, has not articulated a clear plan for dealing with violent threats on its platform. As Amazon wrote:

It’s clear that Parler does not have an effective process to comply with the AWS terms of service. It also seems that Parler is still trying to determine its position on content moderation. You remove some violent content when contacted by us or others, but not always with urgency. Your CEO recently stated publicly that he doesn’t “feel responsible for any of this, and neither should the platform.” This morning, you shared that you have a plan to more proactively moderate violent content, but plan to do so manually with volunteers. It’s our view that this nascent plan to use volunteers to promptly identify and remove dangerous content will not work in light of the rapidly growing number of violent posts.

Apple also removed Parler from its iOS App Store earlier today, citing similar concerns.

“Parler has not upheld its commitment to moderate and remove harmful or dangerous content encouraging violence and illegal activity, and is not in compliance with the App Store Review Guidelines,” Apple wrote. “Your app will be removed from the App Store until we receive an update that is compliant with the App Store Review Guidelines and you have demonstrated your ability to effectively moderate and filter the dangerous and harmful content on your service.”

Google already booted Parler from its app store on Friday, also citing the prevalence of explicitly violent content left up on the platform.

https://arstechnica.com/?p=1734051

On Thursday evening, I wrote about a tweet by the Chinese government’s US embassy praising China’s treatment of its Uighur minority. According to the tweet, China was in the process of “eradicating extremism” among the Uighurs, which the government claimed had “emancipated” Uighur women. “Gender equality and reproductive health were promoted, making them no longer baby-making machines,” the embassy claimed.

When I asked Twitter about this on Thursday evening, a spokesman told me that “this Tweet is not in violation of our policies.” The tweet stayed online for most of the day on Friday. But on Friday evening, the tweet disappeared, replaced by a notice that “this Tweet violated the Twitter Rules.”

“After further review we have taken action on this Tweet for violating our rules against dehumanization,” a Twitter spokeswoman told Ars on Friday evening. “We prohibit the dehumanization of a group of people based on” their religion, race, or ethnicity, among other categories.

Human rights advocates have described China’s treatment of the Uighurs as a demographic genocide. According to the Associated Press, the Chinese government “regularly subjects minority women to pregnancy checks, and forces intrauterine devices, sterilization and even abortion on hundreds of thousands” of women in the Xinjiang region.

Women who resist these birth control measures or have more than the approved number of children are sent to detention camps, according to the AP. “Police raid homes, terrifying parents as they search for hidden children.”

It’s been a busy day for Twitter’s content moderation team. Hours earlier, Twitter permanently banned President Donald Trump from the platform for inciting violence.

https://arstechnica.com/?p=1734010