As was threatened, so has it come to pass: President Donald Trump has vetoed funding for the US military because the massive defense spending bill did not include a provision to repeal Section 230.

The National Defense Authorization Act authorizes $740 billion in defense spending for the upcoming government fiscal year. The NDAA usually moves through Congress with broad bipartisan support, and this year’s is no exception. Both chambers supported the bill by wide, veto-proof margins—the House approved by a vote of 335 to 78, and the Senate approved it 84 to 13.

Trump, however, said in early December he would veto the bill if it did not include an outright repeal of Section 230, and today, with the bill on his desk, he followed through on that threat.

“No one has worked harder, or approved more money for the military, than I have,” Trump said in a statement about the veto, claiming without evidence that the military “was totally depleted” when he took office in 2017. “Your failure to terminate the very dangerous national security risk of Section 230 will make our intelligence virtually impossible to conduct without everyone knowing what we are doing at every step.”

That’s not at all how this works

Section 230, however, has nothing to do with military intelligence. At its broadest, the short snippet of law basically does two things. First, it grants Internet service providers, including online platforms, broad immunity from being held legally liable for content third-party users share. Second, it grants those same services legal immunity from the decisions they make around content moderation.

It’s that content moderation bit that Trump really doesn’t like. He’s been in a protracted feud with Twitter, his platform of choice, since the site first appended a mild fact-checking link to a tweet of his containing election misinformation in May.

Days later, Trump issued an executive order directing various federal agencies to limit social media’s “unchecked power to censor, restrict, edit” or otherwise manipulate user content. Following the executive order, the Federal Communications Commission began a Section 230 rule-making procedure, and the Justice Department eventually sent a proposed rewrite of the law to Congress for its consideration. (Congress did not consider it.)

Trump continued to rail publicly against Section 230 throughout the summer and fall. As rhetoric continued to heat up into and past the November election, both Twitter and Facebook expanded their fact-checking policies for information related to voter suppression and election disinformation. In short, the more Trump claimed without evidence that all mail-in voting is fraudulent (it’s not) or that President-elect Joe Biden’s somehow “stole” the election (he won fairly), the more fact-checking labels Twitter appended to his posts.

So now what?

Congressional leaders, anticipating the veto, already scheduled veto override votes—the House on December 28, and the Senate on December 29.

“My intention was and is to ensure the Senate continues fulfilling our obligation to the men and women of our armed forces,” Senate Majority Leader Mitch McConnell (R-Ky.) said at the time. “I hope the president will not veto this bill.”

However, because we cannot simply squeak through the few waning days of 2020 without at least one more dumpster fire, it appears that Senate Republicans may or may not be particularly inclined to fall in line behind McConnell. Within a half-hour of the veto, give or take, Sen. Lindsey Graham (R-S.C.) tweeted, “Congress should vote to repeal Section 230 as requested by President [Trump]. I will not vote to override presidential veto unless effort is made to wind down Section 230.”

https://arstechnica.com/?p=1731780

The Federal government has reached a deal with drugmaker Pfizer to secure an additional 100 million doses of the Pfizer-BioNTech COVID-19 vaccine before the end of July, the company said today.

Under the terms of the new agreement, the government will pay $1.95 billion for the additional doses. Of the new vaccine doses, 70 million are due by June 30, with the remaining 30 million to be delivered no later than July 31. The agreement also provides US authorities with the option to order up to 400 million additional doses of the vaccine later.

Health and Human Services Secretary Alex Azar said in a statement that the additional Pfizer vaccine “can give Americans even more confidence that we will have enough supply to vaccinate every American who wants it by June 2021,” when added to the 100 million doses the US government has already agreed to purchase from Pfizer, as well as the recently approved Moderna vaccine.

The government has likewise ordered a total 200 million doses of the Moderna vaccine, which is now also in use. Each vaccine requires each person receiving it to get two doses, so 400 million total doses is enough to immunize about 200 million people.

A rocky road

Pfizer initially offered the additional doses in its first round of talks with the US government in July, The New York Times was first to report. At that time, the feds agreed to an initial order of 100 million doses but repeatedly declined to lock in an order for between 100 million and 500 million additional doses, “despite repeated warnings from Pfizer officials that demand could vastly outstrip supply.”

When US officials declined to make a commitment, Pfizer instead reached agreements with other nations to sell the vaccines it could manufacture. In order to reach the new deal with Pfizer to secure an additional 100 million doses in the first half of 2021, the government agreed to invoke the Defense Production Act to give the company access to specialized supplies it needs to ramp up production, The New York Times reported.

The Food and Drug Administration granted emergency use authorization for the Pfizer vaccine very late on Friday, December 11. Shipments of the vaccine to facilities nationwide began almost immediately, and the first immunizations of health care workers were underway on the following Monday morning.

Shortly after the first wave of vaccines went out, however, distribution hit bumps. More than a dozen states found they’d be receiving significantly fewer doses than anticipated—half or less of the expected volume—in the second week of vaccine distribution. States, naturally, asked the feds, and HHS’s Azar identified the “core issue” as “Pfizer’s ability to manufacture” vaccine fast enough around “production challenges.”

However, Pfizer in a statement pointed a finger squarely at the US federal government for the snafu.

“Pfizer is not having any production issues with our COVID-19 vaccine, and no shipments containing the vaccine are on hold or delayed,” the company said on December 17. “This week, we successfully shipped all 2.9 million doses that we were asked to ship by the U.S. Government to the locations specified by them. We have millions more doses sitting in our warehouse but, as of now, we have not received any shipment instructions for additional doses.”

https://arstechnica.com/?p=1731664

On Tuesday, Coronavirus Response Coordinator Dr. Deborah Birx announced that she will end decades of government service after the Biden transition is completed. The move comes after controversy over how she spent her Thanksgiving and articles suggesting that the incoming administration was uncertain about whether to retain her. Birx was a widely respected public health official until taking over the coronavirus response, which has left her associated with the misinformation provided by Trump and many other members of his administration.

Damaged legacy

Birx’s government career started in the 1980s, when she was in the Army and Army Reserve, ultimately reaching the rank of colonel. During this time, she frequently worked at the Walter Reed Army Medical Center but also spent time in the lab of Anthony Fauci at the National Institutes of Health. But much of her reputation is based on her work fighting AIDS, first at the CDC, and later as the US Global AIDS coordinator, where her work was widely praised.

That reputation earned her a prominent place in the US’ response to the COVID-19 pandemic, with Trump naming her the Coronavirus Response coordinator and giving her an influential place on the White House’s Coronavirus Task Force. This, however, ultimately placed her in an untenable position, as Trump himself was a frequent source of misinformation about the pandemic, and much of the White House staff frequently ignored public health guidance originating elsewhere in the government. Birx was left with what turned out to be an impossible task: maintain her job and influence by not publicly contradicting Trump’s misstatements and policies while attempting to ensure that the public got quality information.

Her failure to effectively push back on misinformation severely undercut her credibility with the medical and public health communities. And, in Scott Atlas, Trump eventually found someone who embraced both the misinformation and misguided policies. As a result, despite burning her credibility, Birx ended up sidelined by the White House.

Her service over this time was also notable for a conflict with her former agency, the CDC, over the collection of public health data during the pandemic. Birx shifted the responsibility for collecting data on hospital capacities from the CDC to its parent agency, the Department of Health and Human Services. The move created ill will within the CDC and kept the data from being more widely available until some of it leaked.

More recently, Birx fielded criticism for traveling to a family home over Thanksgiving. While Birx said that everyone at the home was already part of the group she was isolating with, the move seemed to go against public health advice issued by the CDC.

What next?

The incoming Biden administration obviously doesn’t view service with Trump as disqualifying, as he quickly embraced Anthony Fauci and offered him a role as a health adviser. And, earlier this month, there were indications that Birx was interested in continuing to address the pandemic from within the new administration. But those indications were quickly followed by reports that the history described above left many in Biden’s planning circle wary of welcoming Birx, viewing her credibility as severely compromised.

In response, Birx has apparently decided not to push matters and announced she would retire after helping get the incoming administration up to speed. The move will bring an end to a long and distinguished career but will hopefully allow the Biden administration to manage the pandemic without defending the response of the previous one.

https://arstechnica.com/?p=1731684

Members of Congress were given just a few hours to read the massive 5,600-page spending bill that passed both legislative chambers on Monday evening. In addition to authorizing $900 billion in COVID relief spending and $1.4 trillion in other spending, the package also included a number of smaller bills that would not have otherwise become law this legislative session.

These included two significant changes to copyright law. One was the Protecting Lawful Streaming Act of 2020, legislation that Sen. Thom Tillis (R-N.C.) introduced two weeks ago. The act makes it a felony, punishable by up to 10 years in prison, to run a pirate streaming service.

The omnibus also included the CASE Act, a proposal to create a new “small claims court” for copyright infringement. Instead of filing a conventional lawsuit, copyright holders will be able to file a complaint with a new agency called the Copyright Claims Board. The CCB will function much like a court, hearing evidence from both sides and then deciding whether to award damages. But it will develop an informal, streamlined process in an effort to keep the costs of litigation down.

I talked to two digital rights advocates—John Bergmayer at Public Knowledge and Katharine Trendacosta from the Electronic Frontier Foundation—who were surprisingly sanguine about the streaming bill. That’s because the legislation is focused on those who operate pirate streaming services, not their users. Another PK lawyer, Meredith Rose, wrote that “we do not see the need for further criminal penalties,” but she acknowledged that the streaming bill was “narrowly tailored and avoids criminalizing users.”

But Bergmayer and Trendacosta had harsher things to say about the CASE Act. Trendacosta described it as “much worse than the felony streaming bill.”

A “small claims court” with high stakes

Details about how the new Copyright Claims Board will work haven’t been decided yet. Instead, the Copyright Office, a branch of the Library of Congress, is supposed to develop those rules over the coming months. The hope is that the CCB will develop informal procedures that ordinary people can navigate without help from an attorney.

But there are limits to how much a copyright case can be simplified. The process will include a discovery phase where each side can demand relevant documents from the other. Some cases will turn on complex legal issues like the doctrine of fair use. Defendants who want to raise a fair-use defense might not be able to do it without help from a lawyer.

And while the CCB has been billed as a “small claims court,” Trendacosta points out that the sums involved aren’t that small. The maximum penalty in a case is $15,000 per infringement and $30,000 per plaintiff. That’s large enough to impose a substantial hardship on many Americans.

Moreover, low costs can be a double-edged sword. Lower costs might make it feasible for more defendants to defend themselves without formal representation, deterring frivolous claims. But things could also go in the other direction: lowering the cost of bringing complaints could lower the barrier to entry for copyright trolling.

So a lot depends on exactly how the CCB operates. The board will consist of three Copyright Claims officers who will each serve for six years. The officers will have plenty of discretion over what types of cases they hear. If they aggressively vet cases on the front end to prevent abuse of the process, the CCB could wind up being a genuine improvement for users as well as copyright holders.

But groups like EFF and PK worry that the CCB will become a rubber stamp for copyright trolls.

The law does have some provisions designed to prevent abuse of the new process. If someone pursues a case with “a harassing or other improper purpose” or “without a reasonable basis in law or fact,” the CCB can award attorney’s fees to the other party. If someone abuses the CCB process more than once, they can be barred from using the process for a year.

https://arstechnica.com/?p=1731441

More than three dozen state attorneys general last week filed an antitrust suit against Google, accusing the tech behemoth of a slew of anticompetitive behaviors. Among those behaviors, a new report finds, is an explicit agreement from Google to work with Facebook not only to divide the online advertising marketplace, but also to fend off antitrust investigations.

Facebook and Google agreed in a contract to “cooperate and assist each other in responding to any Antitrust Action” and “promptly and fully inform the Other Party of any Governmental Communication Related to the Agreement,” according to an unredacted draft copy of the lawsuit obtained by The Wall Street Journal.

The final version of the suit made public last week (PDF) alleged that Google and Facebook signed a secret agreement in 2018 that “fixes prices and allocates markets between Google and Facebook as competing bidders in the auctions for publishers’ Web display and in-app advertising inventory.”

In short, the suit claims, Facebook in 2017 figured out a new ad-bidding tactic, called header bidding. Google found this to be an “existential threat” and signed a contract with Facebook: in exchange for Facebook not using header bidding, Google would provide Facebook with certain advantages over other auction participants, as well as a portion of the money generated by the ad auctions.

“Google publicly misrepresents that all bidders in publishers’ auctions compete on an equal footing,” the suit adds. “Given the scope and extensive nature between the two companies, Google and Facebook were highly aware that their agreement could trigger antitrust violations. The two companies discussed, negotiated, and memorialized how they would cooperate with one another,” it continues, before becoming redacted to hide specifically how or on what the companies would cooperate.

According to the unredacted draft suit, the WSJ reports, sections included in the final version are an annual price tag on that deal—Facebook promised to spend at least $500 million per year on Google advertising—and a reference to Facebook chief operating officer Sheryl Sandberg signing the deal with Google herself, telling Facebook CEO Mark Zuckerberg in an email that the agreement “is a big deal strategically.”

An internal Facebook document reportedly described the agreement as “relatively cheap” as compared to actually competing against Google, and a Google presentation described the deal as working to “build a moat.”

In a statement to the WSJ, a Google spokesperson said that the allegations were inaccurate and that the deal with Facebook was not particularly secret, telling the paper, “There’s nothing exclusive about [Facebook’s] involvement and they don’t receive data that is not similarly made available to other buyers.”

Facebook similarly disputed the allegations, with a spokesperson telling the WSJ, “Any allegation that this harms competition or any suggestion of misconduct on the part of Facebook is baseless.”

Super-duper illegal

Antitrust law isn’t just about monopolies; the law instead is concerned with corporate behavior, particularly abuse of power. If you just happen to grow naturally into market dominance, that’s fine. If you use anticompetitive tactics to maintain your dominance, however, that’s against the law.

There’s a lot of room for argument and interpretation within competition law. Building a legal case for both potential and actual harms to consumers and to other businesses is tricky work in most instances, and antitrust enforcement is rarely straightforward, as we most often see in major merger cases.

But there is one category of antitrust law that is straightforward, if proven, and that has to do with how companies and their competitors work together to corner a marketplace. “For the most blatant agreements not to compete, such as price fixing, bid rigging, and market division, the rules are clear,” the Federal Trade Commission’s competition guidance explains. “The courts decided many years ago that these practices are so inherently harmful to consumers that they are always illegal, so-called per se violations.”

At this time, the states’ allegations against Google (and Facebook) are just that: allegations. It is not yet proven whether the agreements between Facebook and Google were anticompetitive or above board, and the trial in the Google antitrust suit isn’t expected to begin until September 2023—almost three years from now.

https://arstechnica.com/?p=1731422

Americans who have low incomes or who lost their jobs during the pandemic will be eligible for $50-per-month broadband subsidies under the stimulus package passed by Congress last night. Congress is providing $3.2 billion from the US Treasury for a new Emergency Broadband Connectivity Fund that will be administered by the Federal Communications Commission.

Subsidies won’t be distributed immediately, as it could take a couple of months or more for the FCC to start the program. The $50 monthly payments won’t go directly to broadband users but will be paid to ISPs that provide free or reduced-cost broadband under the program. ISPs will be responsible for verifying each household’s eligibility and seeking reimbursement from the FCC.

The bill text defines the “emergency broadband benefit” as “a monthly discount for an eligible household applied to the actual amount charged to such household, which shall be no more than the standard rate for an Internet service offering and associated equipment, in an amount equal to such amount charged, but not more than $50.” The monthly per-household subsidy is $75 on Tribal lands.

ISPs would not be allowed to charge customers anything if the standard rate for the broadband service is $50 or less (or $75 or less on Tribal lands). ISPs could charge customers the difference between the standard rate and the subsidy; for example, a low-income customer that qualifies for a $50 subsidy would pay $25 per month for a $75 service.

How to qualify

Importantly, Congress is making the subsidies available to any qualifying household even if they have unpaid broadband bills. There are several ways to qualify for an emergency subsidy. Any household with at least one member who meets the guidelines for the FCC’s Lifeline low-income program would qualify. Households are also eligible if they have been approved for the school-lunch or breakfast program, if any member of the household has received a Pell grant in the current award year, or if any household member “meets the eligibility criteria for a participating provider’s existing low-income or COVID–19 program.”

The emergency broadband subsidy is also available if “at least one member of the household has experienced a substantial loss of income since February 29, 2020.” The income loss can be documented by a layoff or furlough notice, an application for unemployment insurance benefits, or similar documentation.

Because the money is coming from the Treasury, the FCC won’t have to use the Universal Service funding that is collected from surcharges on phone bills to fund other programs. The new program doesn’t have a set expiration date but would end when the $3.2 billion is used up or six months after the US Secretary of Health and Human Services declares the COVID-19 public health emergency to be over.

In addition to $50 monthly subsidies, the program encourages ISPs to provide customers with discounted tablets or laptops that can access the Internet. The fund will provide ISPs with a reimbursement of up to $100 for each device as long as the ISP charges the customer less than $50 for the tablet, laptop, desktop computer, or similar Internet-connected device. One device reimbursement would be available per household.

The bill gives the FCC no more than 60 days to issue regulations for implementing the subsidy program. There could be a gap between issuing rules and the program’s start, so it won’t necessarily begin within 60 days.

“Much-needed” response to high broadband prices

The broadband funding received praise from consumer advocacy groups that had urged lawmakers to help low-income Americans purchase Internet service. Free Press VP Matt Wood called the broadband subsidy “a historic achievement” and “a much-needed response to the lack of affordable broadband choices, which is the primary factor driving the US digital divide.”

“It’s clear that lawmakers across the political spectrum recognize how critical it is to ensure that people can afford to connect to the Internet, especially when there’s a need to conduct so much of our daily lives online,” Wood said.

Consumer advocates have repeatedly argued that the US government’s efforts to expand broadband availability haven’t focused enough on making it cheaper. The FCC offers subsidies for Internet service through Lifeline, but that program only provides $9.25 per month in most cases.

Wood told Ars that the $3.2 billion could last eight or nine months if the participation rate is similar to Lifeline. Nationwide, there are 33.2 million Lifeline-eligible households and 8.2 million of them get the Lifeline benefit. The $3.2 billion would cover 64 million monthly payments if the average subsidy is $50, but Wood noted that reimbursements would be smaller when an ISP’s standard broadband rate is less than $50.

“We are thrilled to see the acknowledgment that the cost of broadband service is a barrier that must be addressed,” the National Digital Inclusion Alliance wrote. “Even as we celebrate, we must keep working toward a permanent broadband benefit plus financial support for outreach to eligible populations, digital literacy training,” and other technical help for broadband users.

Consumer-advocacy group Public Knowledge said it is “disappointed that Congress did not provide funding to keep students connected as they study from home” but that the “broadband subsidies will still benefit students and families at risk of losing their connectivity… No American should be forced to go without food, water, electricity, or essential communications over broadband.”

Another $3.8 billion for broadband

Separately from the $3.2 billion subsidy program, the spending bill provides another $3.8 billion for other broadband programs. That includes $1.9 billion for ISPs with 2 million or fewer customers to replace equipment made by Huawei and ZTE, $1 billion for broadband-deployment grants to Tribal lands, $300 million for broadband grants in rural areas, $285 million for connecting minority college students, nearly $250 million for the FCC’s COVID–19 Telehealth Program, and $98 million to improve the FCC’s broadband-availability maps.

https://arstechnica.com/?p=1731412

In the wake of recent allegations against Pornhub and its parent company Mindgeek, senators from both parties have introduced a new bill that would impose sweeping new regulations on online sites, platforms, and apps that host adult content. Though the bill is meant to prevent exploitation and trafficking, critics argue that the changes would create significant new risks and costs both sex workers and the fewer remaining sites that would then host them.

Sens. Ben Sasse (R-Neb.) and Jeff Merkley (D-Ore.) on Friday introduced the Stop Internet Sexual Exploitation Act (PDF), which they described as “groundbreaking legislation that would require all online platforms that host pornography to put in place critical safeguards to protect Americans from sexual exploitation online.”

The bill creates sweeping verification guidelines for any site that hosts adult material: any user who uploads material to such a site would have to verify their identity with the site, and every single video posted would have to come with a signed consent form from every individual who appears in the video. All pornography platforms would also be required to disable downloads of videos they host.

Sites would also be required to post instructions for how to have a video removed from the site for any individual who did not consent to appear in a video and wants it taken down. Additionally, platforms would be required to operate a 24-hour hotline for individuals and law enforcement to use for requesting takedowns, and videos flagged to that hotline would have to be removed within two hours of the call. Anyone who indicates to a site owner that they do not consent to appearing in a specific video would also have to be added to a database that effectively makes a “do not upload” list, and any new material would have to be checked against that list before appearing on a platform.

The bill would make the Department of Justice responsible for making rules about the do-not-include database, and the Federal Trade Commission would enforce the rest.

The deluge

The senators’ press release about the bill specifically cites a recent New York Times report by opinion columnist Nicholas Kristof as one of their motivations for writing it. The story featured interviews with several women who said that videos of them were uploaded to the site without their knowledge or consent when they were children or teenagers and said those videos of their abuse kept being reuploaded to the site for years despite their repeated takedown requests.

“The posting of intimate photos and videos without participants’ consent is a massive invasion of privacy that drives shame, humiliation, and potentially suicide,” Sen. Merkley said. “While some online platforms have recently announced steps to change some practices, much more needs to be done.”

Where Merkley stayed relatively vague, Sasse straight-up named names. “For years, Pornhub and its parent company Mindgeek monetized rape, abuse, and child exploitation,” Sasse said. “While these suit-wearing traffickers got rich, their victims have lived with the pain and fear. That has to end now. Our bill is aimed squarely at the monsters who profit from rape.”

The Times published Kristof’s story on Friday, December 4. By that Sunday, both Mastercard and Visa said they were investigating Pornhub and Mindgeek. By the next Wednesday, Pornhub blocked all uploads from unverified users and downloads from almost everyone. Nonetheless, both Visa and Mastercard stopped accepting payments for Pornhub by Thursday, and by the time the Pornhub story was 10 days old, the site had begun a massive purge of its videos. It hosted roughly 13.5 million at the time the New York Times story went live; it now hosts fewer than 3 million.

Sasse’s office seemingly had some kind of action against Pornhub in mind before the site began to face such widespread scrutiny: the senator sent Attorney General Bill Barr a letter way back in March asking the DOJ to launch an investigation into Pornhub, based on similar allegations to those in NYT piece, arguing that “publicized cases clearly represent just the tip of the iceberg of women and children being exploited in videos on Pornhub.”

Intention vs. outcome

The intentions behind the senators’ bill are good—as a society, we should absolutely be doing what we can to eliminate exploitation not only of minors but also of adults who do not fully consent to participate in sex work, including pornography. Advocates for sex workers, however, have pointed out that the language in the bill is vague and introduces new risks for performers.

Ana Valens, who covers adult entertainment issues for the Daily Dot, summarized many of the risks in a thorough Twitter thread. First, Valens notes, the definition of what entities are covered under the bill is extremely vague: a platform that “hosts and makes available to the general public pornographic images” could cover Pornhub and Mindgeek’s other sites, yes, but also anything from OnlyFans to more general-purpose sites such as Patreon, Reddit, or Twitter. The liability and cost involved in meeting the bill’s terms would likely cause most sites to simply ban the sharing of adult material rather than spend the effort on compliance.

The identity verification requirements also place risk on performers, Valens notes. The database not only sets up an all-or-nothing system, where individuals either must accept appearing in all adult material or no adult material, but also databases get leaked, hacked, and breached all the time, and performers would be forced to put a great deal of trust in the platforms that maintain those databases not to leak their most personal of personal information. In short, Valens concludes, the bill “creates impossible expectations and standards, doesn’t solve online sexual exploitation, and instead creates an incentive to pull adult material from the web altogether, either via NSFW content purges or indie sites closing down.”

Critics are not just working off of hypotheticals; we’ve seen similar things happen before. In 2018, a controversial pair of bills known as SESTA/FOSTA became law. The bills, fully called the Stop Enabling Sex Traffickers Act and the Fight Online Sex Trafficking Act, carved out a narrow exception in Section 230 that eliminated legal immunity for sites where user-generated material includes content promoting or facilitating prostitution.

SESTA/FOSTA was meant to address sex trafficking in the wake of the Backpage takedown. After it became law, however, legitimate sex workers lost access to the platforms where they advertised or worked. Platforms such as Craigslist and Reddit immediately nixed sections of their sites associated with certain transactions.

Sex work advocacy groups have also expanded their own studies of the aftermath of SESTA/FOSTA, and in December 2019, House and Senate Democrats introduced a bill that would have required the Department of Health and Human Services to study its effects.

“Sex workers are disproportionately women of color, transgender, and are by definition the most marginalized in our society. They don’t have people chasing their boats. They don’t have people seeking their contributions,” Rep. Ro Khanna (D-Calif.), said at the time he introduced the bill. The proposal would have studied the effect on homelessness rates, exploitation, mental health, and negotiation ability of sex workers.

Sen. Elizabeth Warren (D-Mass.), who voted in support of SESTA/FOSTA in 2018, co-sponsored the Senate version of Khanna’s bill, saying at the time, “As lawmakers, we are responsible for examining unintended consequences of all legislation, and that includes any impact SESTA-FOSTA may have had on the ability of sex workers to protect themselves from physical or financial abuse.”

https://arstechnica.com/?p=1731155

Three dozen journalists had their iPhones hacked in July and August using what at the time was an iMessage zero-day exploit that didn’t require the victims to take any action to be infected, researchers said.

The exploit and the payload it installed were developed and sold by NSO Group, according to a report published Sunday by Citizen Lab, a group at the University of Toronto that researches and exposes hacks on dissidents and journalists. NSO is a maker of offensive hacking tools that has come under fire over the past few years for selling its products to groups and governments with poor human rights records. NSO has disputed some of the conclusions in the Citizen Lab report.

The attacks infected the targets’ phones with Pegasus, an NSO-made implant for both iOS and Android that has a full range of capabilities, including recording both ambient audio and phone conversations, taking pictures, and accessing passwords and stored credentials. The hacks exploited a critical vulnerability in the iMessage app that Apple researchers weren’t aware of at the time. Apple has since fixed the bug with the rollout of iOS 14.

More successful, more covert

Over the past few years, NSO exploits have increasingly required no user interaction—such as visiting a malicious website or installing a malicious app—to work. One reason these so-called zero-click attacks are effective is that they have a much higher chance of success, since they can strike targets even when victims have considerable training in preventing such attacks.

In 2019, Facebook alleges, attackers exploited a vulnerability in the company’s WhatsApp messenger to target 1,400 iPhones and Android devices with Pegasus. Both Facebook and outside researchers said the exploit worked simply by calling a targeted device. The user need not have answered the device, and once it was infected, the attackers could clear any logs showing that a call attempt had been made.

Another key benefit of zero-click exploits is that they’re much harder for researchers to track afterward.

“The current trend towards zero-click infection vectors and more sophisticated anti-forensic capabilities is part of a broader industry-wide shift towards more sophisticated, less detectable means of surveillance,” Citizen Lab researchers Bill Marczak, John Scott-Railton, Noura Al-Jizawi, Siena Anstis, and Ron Deibert wrote. “Although this is a predictable technological evolution, it increases the technological challenges facing both network administrators and investigators.”

Elsewhere in the report, the authors wrote:

More recently, NSO Group is shifting towards zero-click exploits and network-based attacks that allow its government clients to break into phones without any interaction from the target, and without leaving any visible traces. The 2019 WhatsApp breach, where at least 1,400 phones were targeted via an exploit sent through a missed voice call, is one example of such a shift. Fortunately, in this case, WhatsApp notified targets. However, it is more challenging for researchers to track these zero-click attacks because targets may not notice anything suspicious on their phone. Even if they do observe something like “weird” call behavior, the event may be transient and not leave any traces on the device.

The shift towards zero-click attacks by an industry and customers already steeped in secrecy increases the likelihood of abuse going undetected. Nevertheless, we continue to develop new technical means to track surveillance abuses, such as new techniques of network and device analysis.

Citizen Lab said it has concluded with medium confidence that some of the attacks it uncovered were backed by the government of the United Arab Emirates and other attacks by the government of Saudi Arabia. The researchers said they suspect the 36 victims they identified—including 35 journalists, producers, anchors, and executives at Al-Jazeera and one journalist at Al Araby TV—are only a small fraction of people targeted in the campaign.

NSO responds

In a statement, an NSO spokesperson wrote:

This memo is based, once again, on speculation and lacks any evidence supporting a connection to NSO. Instead it relies on assumptions made solely to fit Citizen Lab’s agenda.

NSO provides products that enable governmental law enforcement agencies to tackle serious organized crime and counterterrorism only, and as stated in the past we do not operate them.
However, when we receive credible evidence of misuse with enough information which can enable us to assess such credibility, we take all necessary steps in accordance with our investigation procedure in order to review the allegations.

Unlike Citizen Lab, which only has ‘medium confidence’ in their own work, we KNOW our technology has saved the lives of innocent people around the world.

We question whether Citizen Lab understands that by pursuing this agenda, they are providing irresponsible corporate actors as well as terrorists, pedophiles, and drug cartel bosses with a playbook for how to avoid law enforcement.

NSO, meanwhile, will continue to work tirelessly to make the world a safer place.

As noted earlier, zero-click zero-days are difficult if not impossible to prevent even by users with extensive security training. As potent as these exploits are, their high cost and difficulty in procuring them means that they’re used against only a small population of people. That means the vast majority of mobile device users are unlikely to ever be targeted by these types of attacks.

In a statement, Apple representatives wrote, “At Apple, our teams work tirelessly to strengthen the security of our users’ data and devices. iOS 14 is a major leap forward in security and delivered new protections against these kinds of attacks. The attack described in the research was highly targeted by nation-states against specific individuals. We always urge customers to download the latest version of the software to protect themselves and their data.”

An Apple spokesman said the company has not been able to independently verify the Citizen Lab findings.

Researchers have yet to determine the precise iOS vulnerability used in these attacks, but Citizen Lab says the exploits don’t work against iOS 14, which was released in September. Anyone still using an older version should upgrade.

https://arstechnica.com/?p=1731271

Google, Mozilla, Apple, and Microsoft said they’re joining forces to stop Kazakhstan’s government from decrypting and reading HTTPS-encrypted traffic sent between its citizens and overseas social media sites.

All four of the companies’ browsers recently received updates that block a root certificate the government has been requiring some citizens to install. The self-signed certificate caused traffic sent to and from select websites to be encrypted with a key controlled by the government. Under industry standards HTTPS keys are supposed to be private and under the control only of the site operator.

A thread on Mozilla’s bug-reporting site first reported the certificate in use on December 6. The Censored Planet website later reported that the certificate worked against dozens of Web services that mostly belonged to Google, Facebook, and Twitter. Censored Planet identified the sites affected as:

• • google.com
  • youtube.com
  • facebook.com
  • vk.com
  • instagram.com
  • twitter.com
  • mail.ru
  • allo.google.com
  • android.com
  • cdninstagram.com
  • dns.google.com
  • docs.google.com
  • encrypted.google.com
  • goo.gl
  • mail.google.com
  • messages.android.com
  • messenger.com
  • news.google.com
  • ok.ru
  • picasa.google.com
  • plus.google.com
  • sites.google.com
  • tamtam.chat
  • translate.google.com
  • video.google.com
  • vk.me
  • www.youtube.com
  • www.messenger.com
  • www.google.com
  • www.facebook.com
  • www.instagram.com
  • groups.google.com
  • hangouts.google.com

Instead of sending traffic that could only be decrypted by the website and the individual end user, computers that had the certificate installed used a key that the Kazakhstan government could also use to decrypt the data in transit.

This is at least the second time Kazakhstan’s government has required some of its citizens install the certificate, with the last time being in August 2019. The major browser makers blocked that overture as well.

Censored Planet said the percentage of hosts inside Kazakhstan experiencing the interception was about 11.5 percent, up from 7 percent last year.

https://arstechnica.com/?p=1730987

Late Friday, the Food and Drug Administration issued an emergency authorization to a COVID-19 vaccine from a company called Moderna. The move follows an enthusiastic endorsement of the vaccine following an evaluation of clinical trial data by the FDA’s Vaccines and Related Biological Products Advisory Committee. Moderna already has millions of doses prepared, and the federal government has pre-issued a large order for more, which will enable more extensive vaccinations than would be possible previously, where the agency had only issued an authorization to the Pfizer/BioNTech vaccine.

The authorization was considered to be a matter of time following the release of safety and efficacy data from a large clinical trial that had enrolled over 30,000 people. Emergency Use Authorizations require that a product or treatment meet a number of criteria, including the declaration of a medical emergency, which was done earlier this year, and the lack of an FDA approved alternative. (FDA approval is distinct from an Emergency Use Authorization, so the authorization of the Pfizer/BioNTech vaccine isn’t a barrier to further authorizations.)

Beyond that, the product must be considered likely to be effective, and its potential benefits need to outweigh its potential risks. The votes from the members of the Vaccine Advisory Committee were unanimous that the benefits outweighed the risks, a conclusion that was well supported by the clinical trial data. That cleared the way for Friday’s Authorization, which took place on a similar schedule to the authorization of the Pfizer/BioNTech vaccine the week prior.

The Moderna vaccine is based on the same RNA technology used by Pfizer/BioNTech. Provided that the companies don’t use the same suppliers for its ingredients, having a second company producing vaccines should ensure more rapid availability. In addition, the US government has committed to a larger purchase of the Moderna vaccine prior to the availability of the clinical trial data. The company has indicated that it already has millions of doses produced; assuming distribution runs along the same lines as with the Pfizer/BioNTech vaccine, people should start receiving doses of the Moderna version on Monday.

That said, it will be many months until the vaccine is widely available. The first doses will be going to health care workers and those considered to be at the highest risk of severe COVID-19.

In terms of preventing COVID-19, the trial data indicated that the Moderna vaccine is over 94 percent effective. Its side effects are typical of all vaccines, and simply indicative of the production of an immune response: soreness at the site of injection, and general fever and fatigue. The authorization cautions against use by those with a history of anaphylactic reactions, and doesn’t cover those under 18 years old. It also calls on the company to continue its clinical trial, and gather safety data from those who receive it under the Emergency Use Authorization.

https://arstechnica.com/?p=1730996