Ticketmaster has agreed to pay a $10 million criminal fine after admitting its employees repeatedly used stolen passwords and other means to hack a rival ticket sales company.

The fine, which is part of a deferred prosecution agreement Ticketmaster entered with federal prosecutors, resolves criminal charges filed last week in federal court in the eastern district of New York. Charges include violations of the Computer Fraud and Abuse Act, computer intrusion for commercial advantage or private financial gain, computer intrusion in furtherance of fraud, conspiracy to commit wire fraud, and wire fraud.

In the settlement, Ticketmaster admitted that an employee who used to work for a rival company emailed the login credentials for multiple accounts the rival used to manage presale ticket sales. At a San Francisco meeting attended by at least 14 employees of Ticketmaster or its parent company Live Nation, the employee used one set of credentials to log in to an account to demonstrate how it worked.

A hack, then a promotion

The employee, who wasn’t identified in court documents, later provided Ticketmaster executives with internal and confidential financial documents he had retained from his previous employer. The employee was later promoted to director of client relations and given a raise. Court documents didn’t identify the rival company, but Variety reported it was Songkick, which in 2017 filed a lawsuit accusing Ticketmaster of hacking its database. A few months later, Songkick went out of business.

The charges against Ticketmaster come 26 months after Zeeshan Zaidi, the former head of Ticketmaster’s artist services division, pled guilty in a related case to conspiring to hack the rival company and engage in wired fraud. According to prosecutors, the former rival employee emailed the login credentials to Zaidi and another Ticketmaster employee.

“When employees walk out of one company and into another, it’s illegal for them to take proprietary information with them,” FBI Assistant Director William Sweeney Jr. said in a statement. “Ticketmaster used stolen information to gain an advantage over its competition, and then promoted the employees who broke the law.”

Besides providing login credentials, the former employee also showed Ticketmaster managers how to exploit a flaw in the URL generation scheme the rival used for unpublished ticketing webpages. To prevent the pages from being accessed by outsiders before they were made public, each one had a unique numerical value. The former employee told his new employer that the values were generated sequentially, and outsiders could use this information to view artist pages while they were still in early draft stages.

In early 2015, Ticketmaster assigned one of its employees to learn about this system and use it to maintain a spreadsheet listing every ticketing webpage that could be located. Ticketmaster would then identify the rival company’s clients and “attempt to dissuade them from selling tickets through the victim company,” federal prosecutors said. Zaidi, the prosecutors further said, explained that “we’re not supposed to tip anyone off that we have this view into [the victim company’s] activities.”

Besides paying the $10 million fine, Ticketmaster has also agreed to maintain a compliance and ethics program designed to prevent and detect future hacking and unlawful acquisitions of competitors’ confidential information. Live Nation representatives didn’t respond to a message seeking comment for this post.

https://arstechnica.com/?p=1732823

A British judge today rejected the US’ request to extradite WikiLeaks founder Julian Assange, saying that Assange would be at greater risk of suicide in the American prison system.

“I am satisfied that, in these harsh conditions, Mr. Assange’s mental health would deteriorate causing him to commit suicide with the ‘single minded determination’ of his autism spectrum disorder. I find that the mental condition of Mr. Assange is such that it would be oppressive to extradite him to the United States of America,” District Judge Vanessa Baraitser wrote in the ruling.

While Assange had “no episodes of self-harming behaviour or suicide attempts during his period of imprisonment at Belmarsh,” a prison in London, Baraitser wrote that Assange’s mental health would deteriorate “if he is subjected to the extreme conditions of SAMs,” the “special administrative measures” used by the US to protect national security information. Baraitser wrote:

[M]any of the protective factors currently in place at HMP Belmarsh would be removed by these conditions. Mr. Assange’s health improved on being removed from relative isolation in healthcare. He has been able to access the support of family and friends. He has had access to a Samaritans phoneline. He has benefited from a trusting relationship with the prison In-Reach psychologist. By contrast, a SAMs regime would severely restrict his contact with all other human beings, including other prisoners, staff and his family. In detention subject to SAMs, he would have absolutely no communication with other prisoners, even through the walls of his cell, and time out of his cell would be spent alone.

Epstein suicide cited in ruling

Defense witness Maureen Baird, who was a warden at the Metropolitan Correctional Center in New York, “described the only form of human interaction coming from correctional officers who open the viewing slot during their inspection rounds of the unit, from institution staff walking through the unit during their required weekly rounds, or when meals are delivered through the secure meal slot in the cell door,” the judge wrote. Baraitser also cited research finding that inmates’ communication with family is “so limited and degraded through delay and constant monitoring, as to render it worthless.”

Baraitser’s ruling noted that “Jeffrey Epstein committed suicide at the MCC jail in August 2019” and Chelsea Manning “was hospitalised after an attempt to commit suicide at the ADC jail [William G. Truesdale Adult Detention Center in Alexandria, Virginia] in 2020.”

“Faced with conditions of near total isolation and without the protective factors which moderate his risk at HMP Belmarsh, I am satisfied that the procedures described by Dr. Leukefled [a psychologist employed as an administrator by the US Bureau of Prisons] will not prevent Mr. Assange from finding a way to commit suicide,” Baraitser wrote.

A psychiatrist who served as a US witness said that Assange’s suicide risk related to extradition was not “substantial.” However, Baraitser accepted the opinions of defense witnesses, including neuropsychiatrist Michael Kopelman, who “diagnosed Mr. Assange with a recurrent depressive disorder, which was severe in December 2019 and sometimes accompanied by psychotic features (hallucinations) and often with ruminative suicidal ideas. He also diagnosed post-traumatic stress disorder (PTSD) relating to an incident when Mr. Assange was 10 years old; generalised anxiety disorder with symptoms that overlap with features of the depression and PTSD; and traits of autism spectrum disorder (ASD).”

Assange’s symptoms in December 2019, before he was transferred from the isolated healthcare unit to the prison’s general population, “included loss of sleep, loss of weight, impaired concentration, a feeling of often being on the verge of tears, and a state of acute agitation in which he was pacing his cell until exhausted, punching his head or banging it against a cell wall,” the judge’s ruling said. Assange told Kopelman that he had been thinking about suicide hundreds of times a day.

“Professor Kopelman considered that, if housed in conditions of segregation and solitary confinement [in the US], Mr. Assange’s mental health would deteriorate substantially resulting in persistently severe clinical depression and the severe exacerbation of his anxiety disorder, PTSD and suicidal ideas. He has not tolerated the relative isolation of the healthcare unit well,” the judge wrote.

US to appeal; Assange lawyers ask for release

Assange is still in prison in London, and the US said it would appeal. “Lawyers for the US government said they would appeal the decision, and the US Department of Justice said it would continue to seek Assange’s extradition,” the Associated Press reported today. “Assange’s lawyers said they would ask for his release from a London prison where he has been held for more than 18 months at a bail hearing on Wednesday,” it added. Assange was arrested by British police in April 2019.

Despite blocking Assange’s extradition on mental-health grounds, the judge ruled that the US’ extradition request was not “an abuse of process” and that “the defence has not established that Mr. Assange has been the target of a politically motivated prosecution.”

“There is no evidence that federal prosecutors were pressurised by the Trump administration into bringing charges. Nor is there evidence that the federal prosecutors who brought these charges have acted in bad faith,” the judge wrote. She also “found that Mr. Assange’s conduct is capable of amounting to an offence in England and Wales.”

The ruling said the US extradition request alleged that Assange was involved in “a broad conspiracy with Ms. Manning and other unnamed persons to commit computer intrusion,” and that he “aided and abetted Ms. Manning” in gaining access to confidential documents later published by WikiLeaks. The US further alleged “the publishing of documents which contained the names of informants,” and the extradition “request sets out in detail not just the damaging nature of the disclosures but also that Mr. Assange knew that the dissemination of the names of individuals endangered them.”

The judge was not convinced by the Assange defense’s argument that he “was acting within the parameters of responsible journalism” when WikiLeaks published 251,000 secret US diplomatic cables without redactions in 2011.

“[I]n stark contrast to Mr. Assange’s final, indiscriminate disclosure of all of the data, newspapers who had worked with him from both sides of the Atlantic condemned his decision,” she wrote. “These traditional news media outlets contrasted their own careful editorial decisions not to publish these names, with what they describe as a ‘data dump’ carried out by Mr. Assange.”

Attorney Eric Lewis told the British court that Assange, if extradited, faces a “best-case scenario” of 20 years in prison. Assange is 49 years old.

https://arstechnica.com/?p=1732802

More than 225 workers at Google have formally launched a company-wide union membership drive, following an increasing drive toward organization inside the company over the past several years.

All 120,000 people who work for Google parent company Alphabet, including temporary, contract, and part-time workers, will be eligible for membership in the Alphabet Workers Union, according to a joint statement from the union and the Communications Workers of America, of which it is a part.

“Our company’s motto used to be, ‘don’t be evil,'” the chair and vice chair of the new union wrote in a New York Times op-ed. “An organized workforce will help us live up to it.”

They added, “For far too long, thousands of us at Google—and other subsidiaries of Alphabet, Google’s parent company—have had our workplace concerns dismissed by executives… Both of us have heard from colleagues—some new, some with over a decade at the company—who have decided that working at Alphabet is no longer a choice they can make in good conscience.”

As of the time the Alphabet Workers Union went public on Monday, 226 workers had signed union cards, organization leadership said.

“Of course our employees have protected labor rights that we support,” Kara Silverstein, director of people operations at Google, said in a statement responding to the unionization drive. “But as we’ve always done, we’ll continue engaging directly with all our employees.”

A long time coming

In both their op-ed and press release, the union leaders cite several incidents in the past three years where Alphabet workers came together to protest choices made by company leadership. In 2018, for example, more than 4,000 Google employees objected to the company’s “Project Maven” drone contract with the Department of Defense, including at least 12 who resigned. Google eventually decided not to renew the contract.

Later in 2018, roughly 20,000 Googlers staged a walkout to protest the company’s (mis)handling of sexual misconduct allegations. Multiple executives who left the company amid allegations of misconduct got to step away quietly with tens or hundreds of millions of dollars in compensation packages, eventually leading to a shareholder suit against Alphabet.

The last straw for many employees appears to have been Google’s recent firing of widely respected AI ethics researcher Timnit Gebru, who described the company’s decision to block publication of her research paper as part of a pervasive attitude inside Google to silence marginalized voices, including women and people of color (Gebru herself is Black).

Google has historically not taken kindly to organized resistance from its workforce. In 2019, the company secured the services of infamous union-busting firm IRI Consultants. Later that year, it fired several tech workers who were prominent internal organizers.

The National Labor Relations Board recently determined several of the 2019 firings were unlawful retaliation against legally protected workforce organization efforts and alleged that Google has a history of “interfering with, restraining, and coercing employees” against protected organization activity.

https://arstechnica.com/?p=1732730

Ether, the native currency of the Ethereum network and the second most valuable cryptocurrency, has soared above $1,000 for the first time since 2018. The rise is part of a broad cryptocurrency boom inspired by the continued rise in bitcoin’s price.

Last month, bitcoin rose above $20,000, smashing its previous all-time record of around $19,500. Since then, it has continued to rise, breaking above $30,000 in recent days. As I write this, one bitcoin is worth around $31,000.

Cryptocurrencies tend to rise and fall together. So it’s not surprising that other virtual currencies are also on the rise. Ether has seen dramatic gains over the last year. At the start of 2020, one ether was worth around $140. The price rose to around $600 in late November, the same month bitcoin started flirting with a new record. In the last few days, ether has been on a tear, rising from $600 on Christmas Day to more than $1,000 today.

It isn’t just ether. Litecoin, one of the oldest “altcoins,” has seen its value triple over the last three months to $150. Bitcoin Cash, a variant of bitcoin that’s optimized for high transaction volumes, has nearly doubled over the same period and is now worth $400.

A new cryptocurrency called Polkadot has tripled in value since it was introduced in August. Polkadot was co-founded by Gavin Wood, who was also a co-founder of Ethereum, so investors are hoping it will be the “next Ethereum.” Polkadot has already become one of the 10 most valuable cryptocurrencies, eclipsing virtual currencies that have been around for much longer.

Recent months have also seen continued growth in Tether, a cryptocurrency whose value is pegged to the US dollar. Cryptocurrency traders like Tether because it enables them to hold virtual dollars without the paperwork hassles imposed by the conventional banking system. While experts have long warned about the currency’s shaky foundations, it has maintained its $1 peg for several years. Over the last year, the value of Tether coins in circulation has grown by a factor of five—from $4 billion in early 2020 to $21 billion today.

One exception to the general bullishness of the cryptocurrency market is XRP, the currency of the Ripple network. Just before Christmas, the Securities and Exchange Commission charged two Ripple executives with selling unregistered securities. The SEC action looks all the way back to the original issuance of XRP in 2013, raising doubts about the legal foundations of the Ripple network. The announcement has caused some US cryptocurrency exchanges to stop offering trades in XRP. XRP has lost two-thirds of its value since a November peak.

Overall, bitcoin continues to dominate the cryptocurrency market. The value of all bitcoins in circulation is $580 billion. The number two cryptocurrency, ether, is worth $115 billion. Tether is worth $21 billion, and XRP is worth $10 billion. No other cryptocurrency is worth more than $10 billion, and the value of all other cryptocurrencies put together is about $120 billion, according to CoinMarketCap. Bitcoin accounts for 68 percent of the value of the entire cryptocurrency market.

https://arstechnica.com/?p=1732736

One of the astonishing aspects of the human response to the Covid-19 pandemic has been how quickly scientists pivoted to studying every facet of the virus in order to mitigate the loss of life and plan for a return to normalcy. At the same time, a lot of non-coronavirus research ground to a near halt.

With research labs and offices shuttered for all but essential workers, many scientists were stuck at home, their fieldwork and meetings canceled and planned experiments kicked down the road as they struggled to figure out how to keep their research programs going. Many took the opportunity to catch up on writing grants and papers; some—in between caring for kids—came up with strategic workarounds to keep the scientific juices flowing.

To gauge how researchers in different fields are managing, Knowable Magazine spoke with an array of scientists and technical staff—among thema specialist keeping alive genetically important strains of fruit flies, the maintenance chief of an astronomical observatory working to keep telescopes safe and on standby during the lockdown, and a pediatrician struggling to manage clinical trials for a rare genetic disease. Here are a few slices of scientific life during the pandemic.

Agnieszka Czechowicz, Stanford University School of Medicine

Pediatrician Agnieszka Czechowicz, Stanford University[/ars_img]Czechowicz is a pediatrician in Stanford’s division of stem cell transplantation and regenerative medicine, where she manages a research group that develops new therapies and conducts clinical trials on rare genetic diseases.

Agnieszka Czechowicz’s father suffers from severe Parkinson’s disease. The coronavirus pandemic forced him to remain indoors and away from people, robbing him of the physical conditioning and social interactions he needs to cope with his disease. A recent fall left him in the hospital, bringing the additional worry that he might contract Covid-19 there and isolating him further.>>For Czechowicz, his situation brought into sharp relief the challenges the coronavirus has forced upon those carrying out clinical trials, including those she is running, which involve patients traveling to hospitals around the country. “Would I have him travel to any clinical site right now for a new Parkinson’s treatment?” she says. “Absolutely not.”

The pandemic forced Czechowicz to halt clinical trials she oversees for a rare genetic disease of children called Fanconi anemia, a condition that impairs the body’s ability to repair damaged DNA and often leads to bone marrow failure and cancer. The treatment Czechowicz and colleagues are testing involves extracting blood-forming stem cells from the patient’s bone marrow, inserting a healthy copy of a missing or malfunctioning gene and then reinfusing those cells back into the patient.

“Every aspect of what I do is massively impacted by the pandemic,” Czechowicz says. One of her early-stage clinical trials involves testing the safety of the therapy. But during the initial shutdown—which started in mid-March and lasted for two months—her patients could not readily travel to Stanford for the necessary follow-up visits, and remote monitoring was difficult.

“There’s special blood testing and bone marrow testing that we need to do. In particular, it’s critical to get the samples to make sure the patients, for example, aren’t developing leukemia,” she says. “There’s no way to know that without really checking the bone marrow.” She had to clear large hurdles to get her patients evaluated.

Another early-stage trial, designed to determine the effectiveness of the therapy, also had to stop enrolling new patients. Because speed is important when it comes to treating Fanconi anemia—the children are likely losing stem cells all the time—any delay in treatment can be a source of great anxiety for their parents. Czechowicz had to explain to them why the trials were temporarily halted. “It was really challenging to have these discussions with the families,” she says.

With the easing of travel and workplace restrictions, the families began traveling to Stanford in June—but with infections back on the rise, many families are becoming hesitant again, says Czechowicz. Fortunately, her trials are small, so she can guide each family through the process of safely resuming the trials and continuing with follow-up. Her own team also has to follow strict safety protocols. For example, even though her lab has 10 members, only two can be in the lab at any one time, and only one parent is allowed into the clinic with the child.

Not all clinical trials can pay such close attention to individual patients. Large trials with hundreds of patients can involve multiple sites and require much more monitoring, so resuming those remains difficult. Also, restrictions on working full bore are slowing the pipeline for new therapies. “The impact of that, we’re not going to see for many years to come,” Czechowicz says.

Abolhassan Jawahery, University of Maryland, College Park

Jawahery is a particle physicist and a member of LHCb, one of the main experiments at the Large Hadron Collider (LHC) at CERN, the particle physics laboratory near Geneva.

In December 2018, well before the coronavirus pandemic began, the LHC shut down for upgrades. Housed in a 27-kilometer-long tunnel about 100 meters underground, the LHC accelerates two beams of protons, one clockwise and one counterclockwise, and makes them collide head-on at four locations. There, four gigantic subterranean detectors—ATLAS, CMS, LHCb and ALICE—sift through the debris of particles created by the collisions, looking for evidence of new physics. (For example, ATLAS and CMS found the Higgs boson, the fundamental particle of the Higgs field, which gives all elementary particles their mass.)>>For its next set of experiments, which aim to probe the properties of subatomic particles with greater precision, the LHC needed to increase the intensity of its proton beams. Consequently, the four detectors needed to be upgraded too, to handle the resultant higher temperatures and increased radiation at the sites of the particle collisions. The work was on track for a restart around May 2021 until the pandemic swept all the scientists’ careful plans away.

The LHC and its four detectors are each run by a separate collaboration. CERN, which manages the LHC, is hopeful it can restart the collider by February 2022. “They think that they can get the accelerator going if there are no more major catastrophic events,” says physicist Abolhassan Jawahery. But the impact on the four detectors is less clear.

For the LHCb upgrade, Jawahery’s team at the University of Maryland had been working on building about 4,000 extremely sensitive electronic circuit boards. These boards have to be “burned in” before they can be sent to CERN. “We put them in an oven, literally cooking the boards and then running extensive tests in order to get them ready so that we can put them in the accelerator and run them for 10 to 20 years,” says Jawahery. “And none of that could be done during the pandemic shutdown.”

The team resumed its work in June, but with restrictions put in place by the state of Maryland. Jawahery runs two labs, and for months was allowed only two people at a time in one lab and three in the other, making progress extremely slow. Still, his team is fortunate that it does not depend on supplies from countries hit hard by the coronavirus. Other labs weren’t so lucky. Scientists in Milan, for example, built some electronics and detector components for the LHCb, and a lab at Syracuse University in New York built sensors that relied on shipments from Milan. When Milan was completely closed down at the height of the pandemic, Syracuse, too, stopped working on Milan-dependent components.

For Jawahery the lockdown had a silver lining. The LHC’s most recent run had produced about 25 gigabytes of data per second—but his team had found little time to analyze any of it before the pandemic. “We were complaining that we were spending all our time building the new instrument and the data keeps on coming,” he says. When he and his team were locked out of their labs, they turned to their data backlog. “We could do actual physics,” he says. “We are already getting ready to publish some papers.”

https://arstechnica.com/?p=1732427

Security firm Corellium, which develops software that researchers can use to analyze Apple products, has been handed a partial victory in Apple’s lawsuit against it, as a judge ruled that its creation of virtual iOS environments does not violate Apple’s copyrights.

Corellium has since 2017 been creating iOS environments that can run on desktop computers, for use as a research and development tool. Apple sued Corellium in 2019, alleging, “Corellium’s true goal is profiting off its blatant infringement” of iOS, and claiming that the firm “encourages its users to sell any discovered information [about system vulnerabilities] on the open market to the highest bidder.”

Earlier this year, Apple amended the suit to include allegations that Corellium’s work violated the Digital Millennium Copyright Act’s (DMCA) prohibition circumventing or breaking DRM.

US District Judge Rodney Smith for the US District Court for Southern Florida yesterday issued his ruling (PDF) in the case, denying Apple’s motion for summary judgement, and granting part, but not all, of Corellium’s motion for same, finding that Corellium’s actions were fair use but “issues of material facts” still exist.

Granted in part

Smith found for Corellium on the matter of the copyright claim, determining that Corellium was not simply cloning iOS as a means of competing with Apple, but instead was genuinely using Apple’s work as the basis of creating something new.

“Corellium makes several changes to iOS and incorporates its own code to create a product that serves a transformative purpose,” Smith wrote. “Hence, Corellium’s profit motivation does not undermine its fair use defense, particularly considering the public benefit of the product.”

Apple also alleged that Corellium’s behavior “has been entirely improper” and that the company has not acted in good faith. Smith, however, wrote that “Apple’s position is puzzling, if not disingenuous,” as Corellium has a vetting process for clients and “has exercised discretion to withhold the Corellium product from those it suspects may use the product for nefarious purposes.

In short, the court “does not find a lack of good faith and fair dealing” on Corellium’s part, Smith ruled, and “further, weighing all the necessary factors, the Court finds that Corellium has met its burden of fair use.”

Denied in part

Apple’s second claim, that Corellium circumvented its DRM unlawfully under section 1201 of the DMCA, is trickier to handle.

Under Section 1201, creating any kind of end-run around “a technological measure that effectively controls access to a work” is itself unlawful—even if you have a really good reason, such as research or repair, for doing so. Apple, as you would assume, has several technological measures through which it protects iOS.

There are, however, some enumerated exemptions from Section 1201. Every three years the US Copyright Office reviews the list, and can choose to add new exemptions. In 2015, for example, it became legal for researchers to hack voting machines and medical devices in controlled environments for purposes of good-faith security research.

There are Section 1201 exemptions for smartphones, but they are limited specifically to jailbreaking, for software interoperability reasons, and for unlocking devices to move between carrier networks.

Even though Smith found Corellium was engaging in fair use as far as the copyright claim, he rejected the fair use argument as far as the 1201 claim goes. “Here, if the court were to adopt Corellium’s position that fair use is a defense to Apple’s DMCA claim, that would effectively render Section 1201 meaningless,” Smith wrote. “Therefore, Corellium may make fair use of iOS, but it is not absolved of potential liability for allegedly employing circumvention tools to unlawfully access iOS or elements of iOS.”

The legal proceedings related to the Section 1201 claim, therefore, will continue into the new year.

https://arstechnica.com/?p=1732395

Senate Majority Leader Mitch McConnell (R-KY) has thrown a wrench into Congressional approval of an increase in government stimulus relief checks from $600 to $2,000. The House voted overwhelmingly on Monday to increase the payments, as President Trump had advocated for. Instead of voting on the House bill, however, McConnell blocked it and instead introduced a new bill tying higher stimulus payments to Section 230’s full repeal, according to Verge, which obtained a copy of the bill’s text.

It’s a tangled web, but the move is tied to Trump’s veto of the National Defense Authorization Act, which authorizes $740 billion in defense spending for the upcoming government fiscal year. “No one has worked harder, or approved more money for the military, than I have,” Trump said in a statement about the veto, claiming falsely that the military “was totally depleted” when he took office in 2017. “Your failure to terminate the very dangerous national security risk of Section 230 will make our intelligence virtually impossible to conduct without everyone knowing what we are doing at every step.”

Section 230 has nothing to do with military intelligence; it’s a 1996 law designed to protect Internet platforms. At its highest level, the short snippet of law basically does two things. First, it grants Internet service providers, including online platforms, broad immunity from being held legally liable for content third-party users share. Second, it grants those same services legal immunity from the decisions they make around content moderation—no matter how much or how little they choose to do.

As we previously reported, Trump has been railing against Section 230 all summer and fall, even signing an executive order directing various federal agencies to limit social media’s “unchecked power to censor, restrict, edit” or otherwise manipulate user content. But Congress declined to consider the Justice Department’s proposed rewrite of the law.

It appears to be personal for Trump: he resents Twitter in particular, ever since the site first appended a mild fact-checking link to a tweet of his containing election misinformation in May, something which has become a common occurrence as the president stews over his November electoral loss. As Ars’ Kate Cox pointed out last week, “In short, the more Trump claimed without evidence that all mail-in voting is fraudulent (it’s not) or that President-elect Joe Biden’s somehow ‘stole’ the election (he won fairly), the more fact-checking labels Twitter appended to his posts.”

The NDAA usually moves through Congress with broad bipartisan support, and this year’s edition was no exception. Both chambers supported the bill by wide, veto-proof margins—the House approved by a vote of 335 to 78, and the Senate approved it 84 to 13. But Trump said in early December he would veto the bill if it did not include an outright repeal of Section 230. On December 23, two days before Christmas, he made good on that threat.

The section 230 thing continues to just make me laugh…repealing section 230 would be a disaster for Trump. It would mean his tweets would be taken down left and right. Same for many of his supporters.

All of the talk about censorship? Wait til section 230 goes. https://t.co/EwKIhi4xWw

— Yashar Ali 🐘 (@yashar) December 29, 2020

The House leadership was prepared for this. On Monday, the House voted to override Donald Trump’s veto of the National Defense Authorization Act (NDAA) by a vote of 322 to 87—easily exceeding the required two-thirds mark. The measure then went to the Senate, where it must also pass by the same margin to overcome Trump’s opposition. The Senate is expected to also vote to override the veto sometime in the next few days.

So what does this have to do with McConnell’s latest political maneuvering? Think of it as a move to appease Trump with regard to Section 230, while also effectively ensuring that the $2,000 increase in stimulus checks will never pass in the Senate. “During this process, the president highlighted three additional issues of national significance he would like to see Congress tackle together,” McConnell said in a floor statement Tuesday afternoon. “This week, the Senate will begin a process to bring these three priorities into focus.”

But that’s disingenuous at best. As Deadline Hollywood’s Ted Johnson notes, “By tying the payments to another Trump priority—the repeal of Section 230—McConnell is likely making the package unsuitable to a number of Democrats in the Senate and the House. Although politicians of both parties have expressed a desire to modify Section 230, it’s a whole other matter to repeal it entirely.”

“Senator McConnell knows how to make $2,000 survival checks reality and he knows how to kill them,” Senate Minority Leader Chuck Schumer (D-NY) said in a statement Tuesday. “Will Senate Republicans go along with Sen. McConnell’s cynical gambit or will they push him to give a vote on the standalone [bill]?”

https://arstechnica.com/?p=1732350

The COVID-19 pandemic accelerated a trend that was already well underway: employers letting their workers perform their jobs remotely, from home, most or all of the time. But even if you and your employer both know exactly where you live and work, you may be surprised to learn that state departments of taxation can have some very different ideas about where “here” is. As a result, Texans, Utahns, and Arkansawyers who work for New York- or Massachusetts-based companies will have income taxes withheld from their paychecks, even if they’ve never set foot in the home office.

In the wake of the pandemic, dozens of major companies are embracing employees’ desire to stay remote, increasing their support for working from home permanently. Some businesses have even closed offices or let leases lapse, counting on a physically distant, flexible workforce to reduce their real estate needs.

In many ways this can be a win/win: employers can save overhead costs on expensive square footage in high-demand cities, and employees can save time and money by skipping the commute and dialing in from, basically, anywhere they want. New York, San Francisco, and Los Angeles are expensive; maybe you want to move to Montana and dial in from the woods, or get a nice little ocean-view place in Florida. Unfortunately, as far as the state is concerned, your beachside cabana may as well be squarely in the middle of Manhattan, and you will be taxed as such.

Boundaries

Even before COVID, living in one state but working in another was a common situation in many of the biggest US metropolitan areas. Many commuters into New York live in New Jersey or Connecticut, for example, and huge numbers of workers in Washington, DC live in Maryland, Virginia, or sometimes even farther out in Pennsylvania, West Virginia, or Delaware. Kansas City sprawls into both Kansas and Missouri, so traveling across city limits can mean crossing state lines. Any major city near a border likely has loads of workers that saunter over that line every day.

That’s tricky, from a tax perspective, because both the state where you perform a job and the state where you actually live are going to want to try to tax your income. Still, only one state at a time can, and most jurisdictions with a lot of overlap have agreements worked out with their neighboring states that make it easy for workers to take state withholdings and pay state tax where they actually live. (I, for example, only had to fill out one short form when I worked in downtown Washington, DC to make sure my taxes were properly withheld across the river in Virginia.)

The increase in remote work, however, means as offices downsize, some employees are now migrating to areas of the country where there are not tax agreements in place, leaving individuals to try to muddle through multiple states’ tax codes on their own. Even more challenging: states are losing money hand over fist due to the pandemic, and are likely to be more aggressive about chasing down every dollar they can claim.

Seven states—Arkansas, Connecticut, Delaware, Massachusetts, Nebraska, New York, and Pennsylvania—have so-called “convenience” rules on the books that require any work performed for an employer based in their state to be taxed as if the worker performing the job is in their state, no matter where the employee is actually located. Those states are still attempting to collect tax from telecommuting workers, and other states are fighting back.

New Hampshire, which is one of nine states that does not have an income tax, is suing neighboring Massachusetts over its convenience rule. Four other states—New Jersey, Connecticut, Hawaii, and Iowa—are supporting the suit.

https://arstechnica.com/?p=1732300

Despite over 82 million cases and over 1.75 million deaths due to COVID-19, many people are bound and determined to carry on with normal life. For some, that includes attending Saturday night ragers, just like they did in the Before Times. Reports of yet another secret party being broken up by law enforcement have become distressingly common.

Getting guests for these secret parties is at least slightly more difficult now that Apple has pulled Vybe Together—an app with a tagline that invited users to “get their party on”—from the App Store. The Verge pointed out that the app had largely been flying under the radar until a tweet from Taylor Lorenz of the New York Times brought some unwelcome, but much-needed scrutiny to the app. One of Lorenz’s tweets highlighted Vybe Together’s TikTok account, which had posted videos of unmasked people partying indoors while advertising New Years Eve parties. According to Business Insider, TikTok has since removed Vybe Together’s account for violating community guidelines.

Vybe Together’s FAQ at least acknowledged the reality of the COVID-19 pandemic. “We are aware that Covid is a major health problem to the country, our communities, our friends and family. If we could all just be in isolation this could actually go away.” So far, so good.

“Having large scale parties is very dangerous,” the FAQ continued. “That is why we don’t support that. But Vybe is a compromise, no big parties but small gatherings.”

The problem is that in places like New York, where the app was advertising, the number of people from different households who can safely gather indoors and unmasked is zero. The behavior Vybe Together encouraged is inherently dangerous, both to the participants and those they live with.

A spokesperson explained that the app was really meant for small get-togethers. “Vybe Together was [a minimum viable product] designed to help other people organize small get-togethers in parks or apartments during COVID,” the spokesperson told The Verge. “We never hosted any large parties, and we made one over-the-top marketing video that left a wrong impression about our intentions, which has since been taken down. We do not condone large unsafe parties during a pandemic.”

They only condone having small, unsafe parties.

https://arstechnica.com/?p=1732349

Like thousands of other parents, I decided to get my kids a cheap drone for Christmas. I spent $24 for a plastic flying machine with rudimentary collision-avoidance capabilities. A plastic cage mostly kept small fingers away from the four propellers. The kids were delighted for the first couple of hours.

Then my five-year-old daughter somehow managed to get one of the propellers stuck in her hair. The drone was never the same after that. Instead of hovering in the air, it started veering crazily to one side and falling to the floor. A couple of hours later, I noticed that another propeller—not the one that had grabbed my daughter’s hair—had fallen off entirely. Now when you toss it up it immediately flips over and plunges to the floor.

The kids enjoyed the drone so much in its few brief hours of functionality that I thought I might buy them another one. (Hopefully this one would avoid my daughter’s hair.) If I did more research and spent a bit more money, I hoped I could find a higher-quality model that wouldn’t fall apart after a few hours.

So I went to Amazon.com, searched for “children’s drone,” and sorted by “average customer review,” figuring the best-reviewed drones were likely to be high quality. They weren’t.

“Absolutely love this honey”

The first result of my search was a $23 drone with 6,400 reviews and an impressive five-star average rating. This looked promising!

But then I actually looked at the five-star reviews.

“Absolutely love this honey,” wrote one reviewer in the UK in March 2019. “It’s quite different from any supermarket-purchased honey I’ve tried.”

“If you’re looking to have a taste of Greece without making the journey, this honey does the trick,” wrote another customer the same month. A third customer wrote in January 2019 that it was “dark, luxurious pine honey, not too sweet, absolutely fantastic with strained Greek yoghurt and extra cream.”

When I sorted the reviews by date, I saw that the most recent reviewers actually had bought a drone and they were overwhelmingly not giving it five stars. “Bought this for my Grandson,” a customer wrote on December 26. “He played with it for 2 hours before it broke and is no longer working.” He gave the drone one star.

But the older reviews were for honey. Apparently, the manufacturer had tricked Amazon into displaying thousands of reviews for an unrelated product below its drone, helping the drone to unfairly rise to the top of Amazon’s search results.

The story was similar for the second and third results in my drone search. Both had thousands of reviews with five-star averages. In both cases, many of the five-star reviews were obviously for other products—including a bottle of vodka, a bracelet, and a box of Christmas cards.

In both cases, the most recent reviews were almost all negative reviews from customers who had actually bought the drones. One reviewer claimed that a drone had scratched their son’s face.

This kind of review bait-and-switch is not a new problem. More than two years ago, Buzzfeed’s Nicole Nguyen wrote about other online sellers using the same scam. For example, she found that many of the five-star reviews for a highly-rated iPhone charging dock were actually reviews for a culinary torch.

“Amazon is sprinkled with other examples,” Nguyen wrote. “This iPhone X battery case listing used to be for a leather wallet phone case. This iPhone battery case page was formerly a listing for Lightning charging cables. This Wi-Fi router was previously listed as nano computers and has been collecting reviews since 2003. This neck brace was formerly a shower caddy listing. What was formerly a listing for a guitar-string action gauge is a now a page for magnetic, glue-free eyelashes.”

In an emailed statement, an Amazon spokesman told Ars that the bogus reviews I noticed violated Amazon’s policies.

“We have clear guidelines about when products should be grouped together and we have guardrails in place to prevent products from being incorrectly grouped, either due to human error or abuse,” the spokesperson wrote. “The detail page in question has been fixed, and we are taking appropriate action on the bad actor.”

As a result of Amazon’s action, the top-ranking drone, which previously had more than 6,000 reviews, now has only about 50 reviews and its star rating has dropped to three and a half stars. But the other two listings I mentioned above—both of which I also mentioned in a Monday email to Amazon—still have thousands of positive reviews, including a bunch of obviously bogus ones.

Amazon’s approach to third-party sellers is the opposite of customer obsessed

Whatever action Amazon ultimately takes against these particular vendors Amazon’s broader efforts leave a lot to be desired. A company shouldn’t be able to secure a top slot in search results with such obvious subterfuge.

The top-reviewed drones in Amazon’s search results came from brands with names that seemed to be chosen at random. My drone was made by “HONGXUNJIE.” Other highly-rated drones on Amazon are made by “SHWD,” “Taktoppy,” “SimileLine,” “Hffeeque,” “Mafix,” “MINOSNEO,” and so forth. Clicking on the names of these “brands” takes you to a search result with no additional information on who made these products.

Amazon could easily require sellers to provide some basic transparency about these listings—disclosing where these manufacturers are located, how long they’ve been in business, and which other brands they own. This might make it easier for Amazon to punish companies that try to mislead customers with fake reviews.

Major Internet companies often insist that policing their platforms for misinformation is a logistically insurmountable task. This argument has at least superficial plausibility for companies like Facebook and Twitter that have to deal with billions of pieces of content every week. But maintaining minimum standards for Amazon product listings shouldn’t be so difficult. Amazon isn’t just listing information on its website, it’s offering a product for sale and taking a cut of the sale price. In many cases it’s warehousing and shipping the physical products.

The resulting revenue should give Amazon ample resources to do basic vetting of product listings. Amazon probably can’t verify every claim in a product listing, but it shouldn’t be hard to detect when someone takes a listing for honey and converts it into a listing for a drone. If it can’t be done algorithmically, Amazon can and should hire enough human beings to review every significant change to product listings. It shouldn’t be possible for someone to change a listing for honey into a listing for a drone without anyone in Seattle noticing.

Amazon CEO Jeff Bezos has long claimed that his company is laser-focused on serving the needs of customers—a philosophy he calls “customer obsession.” In some ways, Amazon has lived up to its own hype. Amazon offers low prices, a wide selection, and fast, convenient service. Amazon continues to get better on all these fronts—just this weekend I was able to pay an extra $3 to get same-day delivery on a $9 item.

But quality is also important to customers, and here Amazon seems to be anything but customer-obsessed. Sometimes I want the cheapest product I can get. But other times I’m willing to pay extra to get something that will last longer than a day and won’t injure my children. And for some product categories, Amazon’s website makes it difficult to determine which companies actually have a track record of satisfying customers.

https://arstechnica.com/?p=1732132