Members of Congress fleeing a pro-Trump mob left their offices so quickly that at least one staffer left their computer on and logged into their official email, according to a screenshot posted by a conservative reporter. Elijah Schaffer, a reporter for the Glenn Beck publication The Blaze, wrote that he was “inside Nancy Pelosi’s office” with what he called “revolutionaries” who have “stormed the building.”

“To put into perspective how quickly staff evacuated, emails are still on the screen along side a federal alert warning members of the current revolution,” Schaffer wrote.

A text box on the lower-right corner of the staffer’s screen read “Capitol: Internal Security Threat: Police Activity.”

Schaffer has since deleted the tweet.

Both houses of Congress assembled at the Capitol this morning to ratify the election of Joe Biden to be the next president of the United States. But President Donald Trump, who has refused to recognize his defeat, organized a rally outside to protest the results.

Speaking to thousands of protestors outside the Capitol, Trump warned that if Vice President Michael Pence accepted the election results—as the law and the Constitution require him to do—America would be “stuck with a president,” Biden, “who lost the election by a lot, and we have to live with that for four more years.” Trump vowed that “we’re just not going to let that happen.”

Some of the protestors soon tried to make good on Trump’s threat. They stormed the capitol building and forced their way past Capitol Hill police. As angry rioters began roaming through the hallways, police escorted Vice President Pence, House Speaker Nancy Pelosi, and other members of Congress out of the Capitol building.

With the capitol building still occupied by a violent mob, it’s not clear how much access rioters have gained to sensitive information. With luck, staffers who had access to classified data managed to log off before evacuating their offices. But with thousands of people working on Capitol Hill, it seems likely that some serious data breaches will occur.

https://arstechnica.com/?p=1733326

Frontier Communications has agreed to expand its fiber-to-the-premises network and improve its poor service quality as part of a bankruptcy settlement in California. Frontier committed to deploy fiber to 350,000 homes and businesses within six years on a schedule that would require the first 100,000 by the end of 2022, 250,000 by the end of 2024, and the full 350,000 by year-end 2026.

The settlement, filed in late December, is pending approval by the California Public Utilities Commission (CPUC). Frontier agreed to the terms with the Communications Workers of America (CWA), a union that represents Frontier employees; The Utility Reform Network (TURN), a consumer-advocacy group; and Cal Advocates, the public advocate office at CPUC.

To ensure that Frontier doesn’t build only in wealthy areas, the 350,000-location deployment must include 150,000 customer locations where Frontier estimates it would receive less than a 20 percent “internal rate of return.” For those 150,000 locations, Frontier will have to consult with the CWA, TURN, Cal Advocates, and tribal government leaders “to discuss the potential areas for deployment, including tribal lands and tribal communities,” the settlement said.

“As part of the proposed settlement, Frontier will be required to spend at least $1.75 billion over the next four years on service quality and network enhancement projects, as well as provide a detailed plan with input from CWA, TURN and Cal Advocates that identifies needs like plant repair, maintenance, hiring, and how Frontier intends to address them,” the CWA said in a press release last week. The union said it also “secured a commitment from Frontier to maintain its total employee technician staffing in California over the next three years, and to maintain ten call center locations across the state.”

Another settlement clause requires Frontier to spend $11.6 million over four years to deploy 25Mbps download speeds at 4,000 additional locations on tribal lands. The required upload speeds for this buildout are only 2Mbps, so it likely wouldn’t involve fiber-to-the-home. But tribal areas should get some fiber as part of Frontier’s requirement to deploy at 150,000 low “rate of return” areas.

Frontier agreed to temporary price controls, as it “will not increase residential rates for copper-based standalone voice services, fiber-based standalone basic voice service, copper-based broadband services, and copper-based voice/broadband bundles through December 31, 2021,” the settlement said. Frontier will also have to “provide a host of detailed, recurring reports” on network spending, service quality, and broadband commitments to help advocacy groups and the state monitor the company’s compliance.

Frontier failed to invest in fiber

Frontier filed for Chapter 11 bankruptcy in April 2020 after admitting its financial problems were caused in part by “significant under-investment in fiber deployment.” Frontier provides Internet service in 25 states and has a track record of chronic outages, poor customer service, and missing broadband-deployment deadlines after taking government funding. Frontier is aiming to exit bankruptcy early in 2021.

If approved by state officials, the settlement would require Frontier to issue customer credits of $5 a day when outages last more than 24 hours, or $10 a day on tribal lands. That provision would be in effect for three years. Frontier also “agreed to be subject to enhanced penalties in the form of additional investment of up to $7 million per year” if the company fails to meet the state’s service-quality standards.

Frontier also reached a separate settlement with the California Emerging Technology Fund (CETF) that’s geared toward improving broadband access for people with low incomes, tribal residents, and other underserved populations. This includes distributing 20,000 Wi-Fi-capable devices to low-income students by the end of 2021 and expanding eligibility for public Wi-Fi deployments or free broadband at community locations like schools and libraries.

“Frontier has also agreed to continue to offer its Affordable Broadband and Frontier Fundamental low-income broadband service plans at equal or lower pricing than current rates for an additional time period through December 31, 2023,” the settlement with CETF said.

https://arstechnica.com/?p=1733314

WhatsApp, the Facebook-owned messenger that claims to have privacy coded into its DNA, is giving its 2 billion plus users an ultimatum: agree to share their personal data with the social network or delete their accounts.

The requirement is being delivered through an in-app alert directing users to agree to sweeping changes in the WhatsApp terms of service. Those who don’t accept the revamped privacy policy by February 8 will no longer be able to use the app.

Share and share alike

Shortly after Facebook acquired WhatsApp for $19 billion in 2014, its developers built state-of-the-art end-to-end encryption into the messaging app. The move was seen as a victory for privacy advocates because it used the Signal Protocol, an open source encryption scheme whose source code has been reviewed and audited by scores of independent security experts.

In 2016, WhatsApp gave users a one-time ability to opt out of having account data turned over to Facebook. Now, an updated privacy policy is changing that. Come next month, users will no longer have that choice. Some of the data that WhatsApp collects includes:

• User phone numbers
• Other people’s phone numbers stored in address books
• Profile names
• Profile pictures and
• Status message including when a user was last online
• Diagnostic data collected from app logs

Under the new terms, Facebook reserves the right to share collected data with its family of companies.

“As part of the Facebook family of companies, WhatsApp receives information from, and shares information with, this family of companies,” the new privacy policy states. “We may use the information we receive from them, and they may use the information we share with them, to help operate, provide, improve, understand, customize, support, and market our Services and their offerings.”

In some cases, such as when someone uses WhatsApp to interact with third-party businesses, Facebook may also share information with those outside entities.

A lack of transparency

The move comes a month after Apple started requiring iOS app makers, including WhatsApp, to detail the information they collect from users. WhatsApp, according to the App Store, reserves the right to collect:

• Purchases
• Financial information
• Location
• Contacts
• User content
• Identifiers
• Usage data and
• Diagnostics

A WhatsApp spokeswoman declined to speak on the record about the changes and precisely how or if it’s possible for users to opt out of them. She agreed to email additional information on the condition it be kept on background, meaning none of the details can be quoted verbatim.

The move, the spokeswoman said, is part of a previously disclosed move to allow businesses to store and manage WhatsApp chats using Facebook’s infrastructure. Users won’t have to use WhatsApp to interact with the businesses and have the option of blocking the businesses. She said there will be no change in how WhatsApp shares provides data with Facebook for non-business chats and account data.

Together, the WhatsApp privacy policy and terms of service are more than 8,000 words long and are filled with legal jargon that makes it difficult for non-lawyers to understand. WhatsApp is doing its users a disservice by not agreeing to speak on the record so that reporters can fully understand the changes and explain them to readers.

People who object to the new terms and policy should consider using a different messenger. The Signal messenger provides the same robust encryption engine with a much more transparent privacy policy and terms of service. (Those documents are half the length of those from WhatsApp, too.) Besides providing encrypted chats, Signal also offers encrypted audio and video calls.

Post updated to add details in the third-to-last paragraph.

https://arstechnica.com/?p=1733317

Amazon is planning to spend $2 billion over the next five years to invest in affordable housing in the three cities where its major offices have helped jack up housing prices, the company said today.

The company will be using loans, lines of credit, and grants to “preserve and create” 20,000 committed affordable units for low- to moderate-income families in the general areas around Seattle, Nashville, and Arlington, Virginia, where it has a large corporate presence, Amazon said in a press release this morning.

“Affordable housing” is generally defined as priced to be within reach of families making 80 percent or less of the area median income. Amazon specifically is targeting households coming in between 30 and 80 percent of the area AMI. The AMI for the Washington, DC, metro area, including Arlington, is $126,000, and so basically any household making between $37,000 and $100,800 falls within that range. In Seattle, the AMI is $119,400, and so that window would include households making between approximately $35,800 and $95,500.

Amazon has already made two significant investments in affordable housing in those regions, the company added. The first is a combination loan-and-grant package of $340 million it granted the Washington Housing Conservancy to acquire an apartment complex, Crystal House, in Arlington.

“We don’t have control over how the [housing] markets respond to a large employer coming into the market or expanding in the market, but we can play a role in how Amazon’s growth is impacting our local communities,” Catherine Buell, head of community development for one of Amazon’s philanthropic arms, told The Wall Street Journal. “Particularly as we’re expanding our corporate presence, we’re working to get ahead of the issue as much as we can.”

Amazon’s pledge won support among affordable housing advocates in Virginia. “We’re thrilled that Amazon is really making a quantum leap in their investment in affordable housing,” Nina Janopaul, president and CEO of the Arlington Partnership for Affordable Housing, told Ars. Amazon contributed $1 million to an APAH project in 2020, Janopaul added, “and we look forward to helping to accelerate the development of affordable homes in Arlington with their support.”

Corporate support for affordable housing initiatives from Amazon has also helped boost support at the state level, Janopaul added, which benefits everyone. “So I think it’s a great partnership, that corporate leadership, and then that helps to motivate government leadership. They work in synchrony.”

The Amazon effect

Amazon has been based in Seattle for more than 20 years, so its effect on the local housing market has been slow to build and not always easy to separate out from other factors affecting the city. Over in Virginia, however, Amazon’s much-ballyhooed 2018 “HQ2” announcement had a visible and immediate effect on already-high housing costs.

Arlington has been an expensive place to live for decades, and a major building boom in “luxury” condo and apartment developments near Metro stations over the past 10 to 15 years has only accelerated the upward trend. Amazon’s announcement that it would take office space in an Arlington neighborhood—Crystal City, a stone’s throw from both the Pentagon and Reagan National Airport—added even more fuel to the fire.

In the six months after Amazon made its HQ2 announcement, housing prices in Arlington County rose by almost 18 percent. Speculators jumped in first, within days of the deal becoming public, but regular high-income earners who just wanted to live near Amazon jobs weren’t far behind. By August 2019, Redfin had dubbed Arlington and neighboring Alexandria the most competitive housing markets in the country.

The housing crunch in Arlington is not only terrible for low-income families but challenging for middle-class households as well. When the county published its annual profile in July, the average value of a single-family detached home was $949,500 ($805,000 for a townhouse). Rents are also high: the average rent in Arlington in the 2020 report was $2,024 for a one-bedroom apartment, $2,627 for a two-bedroom, and $3,367 for a three-bedroom.

There are currently about 8,300 committed affordable units in Arlington, so Amazon’s pledge to create thousands more will indeed significantly expand that number. As in California, however, corporate philanthropy can only go so far without an overhaul of local policy to fill in the missing housing gaps.

https://arstechnica.com/?p=1733234

App developers are exploring surreptitious new forms of user tracking to evade Apple’s new privacy rules, which threaten to upend the mobile advertising industry in the coming months.

Early in 2021, an iPhone update will prevent apps from using advertising identifiers known as IDFA without obtaining each user’s explicit consent for targeting. Developers expect more than two-thirds of users will block tracking when they see a popup appear within their apps.

Some app makers say they plan to use invasive tracking techniques such as “device fingerprinting” to work around the new restrictions—even though doing so risks getting them thrown off the App Store if they are caught.

“100 percent, everyone will try doing fingerprints, whether Apple enforces their rules or not,” one mobile games developer said.

Privacy campaigners have welcomed Apple’s changes but warn that it is never possible to eliminate tracking entirely.

“There is still going to be tracking,” said Andrés Arrieta, director of consumer privacy engineering at Electronic Frontier Foundation, a campaigner for digital rights. “We will still see apps trying to do nefarious things. No matter what you do, you will have those bad actors.”

Facebook has led criticism of Apple’s change, taking out a series of newspaper advertisements in December that accused Apple of depriving app makers of as much as half of their ad revenues by removing personalization.

Few other developers are willing to pick a public fight with Apple, whose App Store acts as gatekeeper to a $500 billion economy. But privately, the creators of some of the App Store’s most popular apps are fretting, given the importance of advertising as a means of both revenue and distribution.

“The impact is close to impossible to predict,” said the head of one large mobile games developer.

“This is a huge, huge change,” said the chief of another leading mobile games developer. “It’s the biggest risk that we have [as a company]…  It could really affect us negatively.”

Developers are concerned that many in the advertising industry are still unaware of the magnitude of the coming changes. “Brands and agencies have no idea—they don’t have a full grasp on where the ecosystem is headed,” said a policy executive at one app maker. “Tech intermediaries are being forced to solve the problem.”

Under such pressure, some developers are, in desperation, considering using new and more invasive forms of tracking, even if users deny their apps permission to use IDFA.

Device fingerprinting can be used to recognize repeat visits from the same smartphone, even across multiple apps. The technique, which is banned by Apple’s App Store rules but can be difficult to detect, works by correlating a combination of a device’s hardware and software characteristics, configurations such as Internet connections, battery or language settings, and patterns of usage.

Another way to track people between apps is if they use the same email address to sign up for various services and games. “Hashed emails,” whereby addresses are turned into a string of letters and numbers, allow companies to share user details without directly handing over an individual’s email address to their partners.

While these techniques might be difficult for Apple to detect, the cost of being caught—and losing access to the world’s most lucrative mobile storefront—could be enormous. “Do you want to play with fire?” one developer asked.

© 2020 The Financial Times Ltd. All rights reserved Not to be redistributed, copied, or modified in any way.

https://arstechnica.com/?p=1733276

Hackers working for the Russian government were “likely” behind the software supply chain attack that planted a backdoor in the networks of 180,000 private companies and governmental bodies, officials from the US National Security Agency and three other agencies said on Tuesday.

The assessment—made in a joint statement that also came from the FBI, the Cybersecurity and Infrastructure Security Agency, and the Office of the Director of National Intelligence—went on to say that the hacking campaign was a “serious compromise that will require a sustained and dedicated effort to remediate.”

Russia, Russia, Russia

The statement is at odds with tweets from US President Donald Trump disputing the Russian government’s involvement and downplaying the severity of the attack, which compromised the software distribution system of Austin, Texas-based SolarWinds and used it to push a malicious update to almost 200,000 of its customers.

“The Cyber Hack is far greater in the Fake News Media than in actuality,” Trump wrote in a Twitter thread last month. “I have been fully briefed and everything is well under control. Russia, Russia, Russia is the priority chant when anything happens because Lamestream is, for mostly financial reasons, petrified of discussing the possibility that it may be China (it may!).”

Tuesday’s statement made no mention of China. Instead, it said that the agencies’ investigation so far points to the hack being an espionage operation sponsored by the Kremlin.

“This work indicates that an Advanced Persistent Threat (APT) actor, likely Russian in origin, is responsible for most or all of the recently discovered, ongoing cyber compromises of both government and non-governmental networks,” officials wrote. “At this time, we believe this was, and continues to be, an intelligence gathering effort. We are taking all necessary steps to understand the full scope of this campaign and respond accordingly.”

The statement is the second time Trump has been contradicted by people who work under his administration. Secretary of State Mike Pompeo has also said that Russia “pretty clearly” was behind the hack.

Damage assessment

Since the mass compromise came to light three weeks ago, investigators in both the public and private sectors have scrambled to learn who was behind the hack, who was infected, and what the hackers’ motives were.

SolarWinds, a supplier of network management software, was the source for the figure that 180,000 organizations installed the backdoored update. Since then, researchers elsewhere have said that only a subset of those organizations received a follow-on attack that used the backdoor to install additional malware that burrowed into networks much more deeply.

So far, the agencies have “identified fewer than ten US government agencies that fall into this category, and are working to identify and notify the nongovernment entities who also may be impacted.” Tuesday’s joint statement didn’t name the agencies. Previous media reporting has named the Departments of Defense, State, Treasury, Commerce, Homeland Security, Agriculture, and Energy as victims, but not all of the reporting explicitly says these agencies received the follow-on attack.

On December 31, Microsoft said the hackers used the backdoor in its network to view source code, and the company researchers were continuing to investigate. The entire campaign came to light after FireEye, one of the world’s top security firms, disclosed it had been breached. Security firm CrowdStrike, meanwhile, has said that, although it was also targeted, that attempt failed.

The failure of the NSA and other federal agencies in discovering the months-long hacking operation against some of the most sensitive government agencies and private companies has been a major embarrassment. Tuesday’s statement suggests that the agencies are still struggling to contain and assess the damage that has resulted.

Regardless of how Trump receives Tuesday’s assessment, it sets the stage for the incoming president, Joe Biden, who has assailed Trump for downplaying the hack.

https://arstechnica.com/?p=1733205

With the days counting down to the inauguration of President-elect Joe Biden, the Trump administration has been undertaking a series of actions that will make it more difficult for its replacements to reverse any of its policies or pursue new ones. This is especially true in the area of environmental regulations, where both the Environmental Protection Agency and the Department of Interior have recently issued decisions.

Over the last few days, Interior has issued new rules that will allow industries to kill migratory birds with impunity, and the department has moved ahead with plans to lease portions of the Arctic National Wildlife Refuge for drilling tomorrow. Meanwhile, the EPA has finally pushed through a new rule that could severely limit the ability of the agency to establish future regulations. The only small bit of consolation is that the EPA’s final rule is less awful than some earlier drafts.

Only the science we like

The EPA’s new rule, which will be formally published tomorrow, is an attempt to set additional standards for the evidence it considers when establishing new regulations for pollutants. In principle, the rule sounds great: it wants the data behind the scientific papers it uses to be made publicly available before it can be used to support regulatory decisions. In reality, the rule is problematic, because many of these studies rely on patient records that need to be kept confidential. In other cases, the organizations with the best information on some environmental hazards are the companies that produce or work with them, and they may not be interested in sharing proprietary data.

The practical result of this sort of change is that the EPA would be precluded from relying on scientific papers that contained the clearest indications of public harm. This would almost certainly lead to weaker rules or a decision not to regulate at all.

The attempt to handcuff the EPA has a long history, with congressional attempts to enshrine it in law dating to early in the Trump administration, and drafts of the current rule having circulated within the EPA for years. The New York Times has even traced the idea back to the tobacco industry’s fight against second-hand smoke regulations.

The federal rule-making process requires agencies to incorporate public feedback on draft versions to be incorporated into the final rule, and that was the case here. As a result, the new rule is considerably less damaging to the EPA. As the final version notes, “This rule has a much narrower scope than the 2018 proposed rule.” The original rule had applied to both models of public exposure and dose-response studies of their health impacts be made public; the final version only applies to the dose-response studies. It no longer requires that the EPA perform its own peer review of published peer-reviewed studies and now allows the EPA administrator to allow exceptions that enable the use of studies where the data isn’t publicly available.

Regulations that have been established in the past are now explicitly grandfathered in, although the new rule would apply if a re-evaluation of risks takes place. A large number of overly broad definitions were also tightened up and made more specific in the final version. All of these changes were suggested in the public feedback phase of the rule-making process.

Despite the changes, the final rule will mean that the EPA administrator, a political appointee, will potentially need to be involved in determining which science the agency can consider in setting regulations. Regulations will still be possible, but it will be more difficult to pursue them, and they are likely to be less stringent. Despite that, the EPA contends that it’s doing all of this because it favors public access to data: “The EPA disagrees with the contention that this rule is politically motivated, as transparency assumes no political ideology, nor is this rule likely to result in decreased human health or environmental protections, as the benefits of greater data transparency and the significance of reanalyzing and validating study results are well-documented in scientific literature.”

Interior is not for the birds

The EPA was not alone in attempting to undercut existing environmental regulations. On Tuesday, the Department of Interior published a new regulation that modifies how it will enforce the Migratory Bird Treaty Act. This Act prohibits the killing of the migratory birds that are its subject, and it has been one of the ways the government has punished companies for causing widespread environmental damage that caused bird deaths. The new rule essentially says that oil spills are fine, since they weren’t done with the intention of killing birds.

Secretary of the Interior David Bernhardt said, “This rule simply reaffirms the original meaning and intent of the Migratory Bird Treaty Act by making it clear that the US Fish and Wildlife Service will not prosecute landowners, industry and other individuals for accidentally killing a migratory bird.”

Industry may still face legal jeopardy under the Endangered Species Act and other environmental regulations, but the rule change means that it can otherwise kill birds with impunity, as no industrial activities are pursued explicitly to kill birds.

The move comes the day before the Department of the Interior is scheduled to host an auction of drilling rights in the Arctic National Wildlife Refuge, potentially ending a battle between environmentalists and oil companies that has been going on for decades. A suit to block the auction is pending in Alaska, but it’s not clear if any action will be taken before Wednesday.

Normal, and less so

Efforts to push policy priorities through before a new administration takes office have become commonplace in recent years. Typically, these follow a common course: the new rule prompts lawsuits that prevent it from taking effect. The new administration tells the court it’s withdrawing the rule but then has to take the time to go through the full formal rule-making process to reverse it. Including the time to formulate a new rule, push it through the public comment period, and craft the final rule, this can mean that many of the last-minute changes aren’t reversed until halfway through the new administration’s first term.

That’s the likely fate of the changes to the Migratory Bird Treaty Act. But the drilling leases, since they directly involve sales to commercial concerns, are likely to be far more difficult to roll back once issued. And the changes at the EPA appear to be part of a concerted effort to make all future environmental regulations more difficult to enact.

Earlier this year, the EPA issued new regulations that included the determination that evidence from epidemiology wasn’t sufficient on its own to justify future regulations. Like the new rule on scientific evidence, this appears designed to eliminate the use of most of the scientific evidence that underpins environmental regulations. Epidemiology is how we estimate average exposures for populations and link that to health outcomes in those populations. The only realistic alternative is to install monitoring equipment and then compare that to individual health outcomes, a far more expensive and complex form of study.

The EPA has also acted to make future regulations harder to justify on economic grounds. In April, the Trump EPA announced that it wouldn’t take indirect benefits of regulations into account when performing a cost/benefit analysis. This means that if a regulation would avoid $1 in contamination cleanup but save $1 billion in health costs, only the cleanup costs could be considered.

Overall, these rules will make it much harder to gather evidence to justify regulations on scientific grounds and nearly impossible to justify them on economic ones. Their presence will make it extremely difficult for the Biden EPA to do anything until they are reversed.

https://arstechnica.com/?p=1733176

The highest state court in Massachusetts has rejected Uber’s efforts to force a blind man’s discrimination claims to be settled in arbitration. In the process, the Massachusetts Supreme Judicial Court raised the bar for technology companies trying to impose one-sided terms of service on users without providing clear notice that they were doing so.

When Christopher Kauders signed up for an Uber account several years ago, he had to fill out three screens of information. The third screen was titled “link payment” and offered users various ways to pay for Uber rides. Below these options was a message that stated that “by creating an Uber account, you agree to the Terms and Conditions and Privacy Policy.”

Users could click on a link to view these legal documents, but the app didn’t require users to do so. At no point was Kauders required to click an “I agree” button.

Later, three Uber drivers refused Kauders service because he was accompanied by a guide dog. Kauders sued Uber for illegal discrimination. In an early 2018 ruling, a judge held that Uber’s terms of service required that Kauders’ case go to arbitration. The arbitrator then ruled against Kauders, finding that drivers are independent contractors and hence Uber isn’t responsible for their actions.

“Did not constitute a contract”

But on appeal, Kauders’ lawyers argued that he had never agreed to arbitration in the first place. On Monday, the highest state court in Massachusetts accepted Kauders’ argument, holding that merely mentioning terms and conditions on a registration page wasn’t sufficient to create a binding contract between Kauders and Uber.

“Uber’s terms and conditions did not constitute a contract with the plaintiffs,” the high court wrote (another woman had also sued Uber). The case was sent back down to the lower court.

It’s not clear if Kauders will prevail in the lawsuit. It’s possible that the court will reach the same conclusion the arbitrator did. But the broader impact of the ruling is to put companies on notice that they can’t bind users to restrictive terms merely by linking to those terms somewhere in a site or app’s registration process. In order to create a legally binding contract, a tech company has actually put the terms in front of the user and get them to affirmatively agree to them.

The high court points out that when it’s signing up new drivers, Uber takes a different approach. Before drivers can register, they are required to push a button marked “YES, I AGREE” not once but twice.

“The contrast between the notice provided to drivers and that provided to users is telling,” the court writes. “As Uber is undoubtedly aware, most of those registering via mobile applications do not read the terms of use or terms of service included with the applications.”

Thanks to Ars reader Andrewb610 for pointing me to the ruling.

https://arstechnica.com/?p=1733028

If you’re using an Android device—or in some cases an iPhone—the Telegram messenger app makes it easy for hackers to find your precise location when you enable a feature that allows users who are geographically close to you to connect. The researcher who discovered the disclosure vulnerability and privately reported it to Telegram developers said they have no plans to fix it.

The problem stems from a feature called People Nearby. By default, it’s turned off. When users enable it, their geographic distance is shown to other people who have it turned on and are in (or are spoofing) the same geographic region. When People Nearby is used as designed, it’s a useful feature with few if any privacy concerns. After all, a notification that someone is 1 kilometer or 600 meters away still leaves stalkers guessing where, precisely, you are.

Stalking made simple

Independent researcher Ahmed Hassan, however, has shown how the feature can be abused to divulge exactly where you are. Using readily available software and a rooted Android device, he’s able to spoof the location his device reports to Telegram servers. By using just three different locations and measuring the corresponding distance reported by People Nearby, he is able to pinpoint a user’s precise location.

Telegram lets users create local groups within a geographical area. Hassan said that scammers often spoof their location to crash such groups and then peddle fake bitcoin investments, hacking tools, stolen social security numbers, and other scams.

“Most users don’t understand they are sharing their location, and perhaps their home address,” Hassan wrote in an email. “If a female used that feature to chat with a local group, she can be stalked by unwanted users.”

A proof-of-concept video the researcher sent to Telegram showed how he could discern the address of a People Nearby user when he used a free GPS spoofing app to make his phone report just three different locations. He then drew a circle around each of the three locations with a radius of the distance reported by Telegram. The user’s precise location was where all three intersected.

Hassan asked that the video not be published. The screenshot below, however, gives the general idea.

Fixing the problem

In a blog post, Hassan included an email from Telegram in response to the report he had sent them. It noted that People Nearby isn’t enabled by default and that “it’s expected that determining the exact location is possible under certain conditions.”

Telegram representatives didn’t respond to an email seeking comment.

People Nearby poses the biggest threat to people using Android devices, since they report a user’s location with enough granularity to make Hassan’s attack work. The recently released iOS 14, by contrast, allows users to divulge only a rough approximation of their location. People who use this feature aren’t as exposed.

Fixing the problem—or at least making it much harder to exploit it—wouldn’t be hard from a technical perspective. Rounding locations to the nearest mile and adding some random bits generally suffices. When the Tinder app had a similar disclosure vulnerability, developers used this kind of technique to fix it.

The privacy consequences of Telegram’s People Nearby feature are a good reminder that features can often be abused in ways that aren’t contemplated by the people who develop them. Users who want to keep their whereabouts private should be suspicious of location-based services and do research before installing or turning them on.

https://arstechnica.com/?p=1733117

The government of Singapore said this week it has used data gathered for COVID-19 mitigation purposes in criminal investigations, sparking privacy concerns about contact tracing both in Singapore and elsewhere in the world.

Singapore’s contract-tracing app, TraceTogether, has been adopted by nearly 80 percent of the country’s population, according to The Guardian, and Singaporeans are required to use it to enter certain gathering places such as shopping malls.

TraceTogether’s privacy statement originally read, “Data will only be used for Covid-19 contact tracing,” but it was updated this week to add, “Authorised Police officers may invoke Criminal Procedure Code (CPC) powers to request users to upload their TraceTogether data for criminal investigations. The Singapore Police Force is empowered under the CPC to obtain any data, including TraceTogether data, for criminal investigations,” The Register reports.

“We do not preclude the use of TraceTogether data in circumstances where citizens’ safety and security is or has been affected, and this applies to all other data as well,” Singapore Minister of State for Home Affairs Desmond Tan confirmed Monday. Law enforcement have reportedly already used contact-tracing data during the course of a murder investigation.

Singapore has a long history of using pervasive mass surveillance techniques, including laws that allow law enforcement to compel cooperation with “pre-emptive surveillance.” In more recent years, the country has adopted widespread facial recognition technology, which it will soon use for accessing government programs, such as filing tax returns, as well.

Worldwide fears

Contact tracing in the face of COVID-19 has been neither widespread nor effective here in the United States the way it has in many other nations, including Singapore. There are many reasons for the domestic failures, including too few resources for too many cases, with most states hiring nowhere near the number of trained contact tracers they would need to keep up.

But distrust of governmental authority is also rampant in the US. And it’s not isolated to a single group but instead shows up across the whole political spectrum: conspiracy theorists have one set of concerns about the government, conservatives have another, and disproportionately targeted groups such as Black Americans or undocumented immigrants have still more.

Despite strong efforts on the part of both Apple and Google to develop a privacy-sensitive mechanism for widespread exposure notification, use and support are not widespread. Back in April, half of Americans said they wouldn’t trust such an app, and by June that figure was up to 70 percent of US adults.

Nor are Americans afraid only of apps gathering their personal information. The Pew Research Center in October published a report finding that 40 percent of US adults would not be comfortable speaking with a public health official who contacted them about the coronavirus outbreak. Among those who would speak with a public health official, 27 percent would not feel comfortable sharing the names of people they had seen or the places they had visited, and a solid 50 percent would not share location data from their mobile phones.

Not without reason

US residents are not necessarily wrong to have broad overall concerns that their sensitive data will be surreptitiously gathered and used by law enforcement without their knowledge. In 2020 alone, for example, both the US Secret Service and US Customs and Border Protection were discovered to be purchasing location data from private entities that would have required a search warrant for the agencies to gather on their own.

Low trust and low participation, in their turn, make contact-tracing programs less useful. Several US governments, in attempts to generate higher participation, explicitly promise that information shared with public health entities for purposes of contact tracing will not be shared with law enforcement. New York just adopted a new law that explicitly protects contact-tracing information from being accessed by police or immigration enforcement agencies.

https://arstechnica.com/?p=1733013