The US Department of Commerce has added dozens of Chinese companies to its “entity list” of companies that may not purchase technology from US companies without a license from the feds. The new list includes DJI, the world’s largest drone manufacturer. It also includes SMIC, a major Chinese chipmaker that has done business with Qualcomm and other Western companies.

This is one of the legal weapons the Trump administration used against smartphone-makers Huawei and ZTE a few years ago. The export ban against those two companies had a devastating effect on the companies because it meant they couldn’t get access to Google software, Qualcomm chips, and other Western technologies.

It’s not clear if the export ban will be as damaging to DJI as it was to Huawei and ZTE. Not only has DJI dominated the drone business for years, but Chinese companies dominate significant parts of the drone supply chain. So DJI might not have as much trouble sourcing components from domestic supply chains. Still, the announcement will certainly make it difficult for DJI to maintain its dominance of the drone business outside of China.

The Trump administration’s other major target is SMIC, a Shanghai company that owns and operates semiconductor foundries. In the past, SMIC has counted Qualcomm, Broadcom, and Texas Instruments among its American customers. When rumors began to circulate about an SMIC export ban a few months ago, Qualcomm reportedly began making plans to shift its semiconductor business away from SMIC. Qualcomm’s biggest foundry partners are Samsung and TSMC, so it likely won’t have too much trouble moving away from SMIC.

The US government’s focus with the SMIC listing is to prevent the Chinese company from getting access to the newest generations of semiconductor fabrication technologies.

“Items uniquely required to produce semiconductors at advanced technology nodes—10 nanometers or below—will be subject to a presumption of denial,” the US wrote in a statement announcing the restrictions. The US is concerned that selling cutting-edge semiconductor equipment to SMIC will allow it to fall into the hands of the Chinese military.

https://arstechnica.com/?p=1730775

Broadband and TV providers will finally be required to stop charging “rental” fees for equipment that customers own themselves, thanks to a new US law that takes effect on Sunday.

The bogus fees were outlawed by the Television Viewer Protection Act (TVPA), which was approved by Congress and signed by President Trump in December 2019. The law was originally scheduled to take effect on June 20, but Congress gave the Federal Communications Commission leeway to delay enforcement by six months if the FCC “finds that good cause exists for such an additional extension.”

The FCC in April granted the six-month delay to ISPs, claiming that providers needed more time to comply because of the coronavirus pandemic. That decision delayed implementation of the new requirements until December 20, 2020.

Frontier must finally stop bogus charge

The change is good news for customers of Frontier Communications, which has insisted on charging $10 rental fees to customers who use their own routers. As we wrote in July 2019, Frontier claimed it charges the fee to cover higher support costs for customers who use their own equipment. But Frontier said at the same time that it “cannot support or repair non-Frontier equipment,” contradicting its own justification for charging the fee.

Frontier took advantage of the six-month delay, telling Ars in June that it would “comply with the requirements when the law goes into effect” in December. Unlike Frontier, other major ISPs such as Comcast let customers avoid rental fees when they use their own routers.

The law’s implementation will “put an end to the unconscionable business practice of charging consumers a rental fee for cable modem routers even if consumers do not use them!” consumer-advocacy group Public Knowledge said in a blog post. “This common-sense correction will permit consumers to continue to use their own equipment, and not be forced to pay for something they neither asked for nor needed.”

When contacted by Ars today, Frontier said it is now “in compliance with the Television Viewer Protection Act. Customers that are charged for covered equipment may return equipment and will not have equipment charges. If a customer uses their own equipment, they may face compatibility issues with their service depending on the equipment, and Frontier may not be able to provide technical support.”

The new law, passed as part of a budget bill, creates a “consumer right to accurate equipment charges” that prohibits TV and broadband providers from charging for “covered equipment provided by the consumer.” Covered equipment is defined as “equipment (such as a router) employed on the premises of a person… to provide [TV service] or to provide fixed broadband Internet access service.” The companies may not charge rental or lease fees in cases when “the provider has not provided the equipment to the consumer; or the consumer has returned the equipment to the provider.”

New cable-TV transparency rules

The law also includes a right to transparency that requires TV providers to inform customers of the total monthly charges, including all company-imposed fees and a good-faith estimate of all government-imposed fees and taxes, before they enter into a contract. This notice must specify the amount of promotional discounts and when those discounts will expire. The law also gives customers a 24-hour period in which they can cancel new TV service without penalty.

The new rule won’t prevent TV providers from raising prices on existing customers, even when they’re under contract. For years, cable companies have been regularly increasing the “Broadcast TV” and “Regional Sports Network” fees that are excluded from advertised prices and requiring all customers to pay the higher rates regardless of their contract status.

But the new transparency requirement is a step in the right direction. “For years, consumers have been misled by pay-TV providers advertising service for one price and then charging another,” Public Knowledge Senior VP Harold Feld said in a press release today. “Until now, consumers have had zero recourse for dealing with these surprise fees other than ending service and paying an unfair termination fee for the privilege. Not anymore.”

Public Knowledge said the required 24-hour cancellation period will help prevent situations in which consumers sign up for TV service and then realize, after it’s too late to cancel without penalty, “that they’d be charged hundreds of dollars a year in unexpected fees.” Public Knowledge’s blog post also said the law’s implementation will help prospective Comcast customers, though not existing customers:

Importantly, this legislation will go into effect just in time to help consumers who are considering signing up for pay-TV service from Comcast. The company recently announced it would be raising its company-imposed fees like the Broadcast TV Fee and the Regional Sports Fee starting on January 1, 2021. These skyrocketing fees could cost Comcast customers an additional $78 a year. While the TVPA doesn’t do much to help existing pay-TV customers, who will now be forking over enough money for a month or two of car insurance despite not knowing they would be doing so when purchasing their service, it would help new customers avoid signing up for a service they can’t afford.

While the ban on charging rental fees for equipment that customers own applies to both TV and broadband service, the other transparency requirements affect only TV service. “Although the TVPA helps new customers avoid signing up for a budget-busting pay-TV service marketed at a significantly lower price, it doesn’t extend to Internet service,” Feld said. “We urge Congress to expand the requirements to Internet service providers so no consumer gets surprised by—and locked into paying—outrageous telecommunication fees.”

https://arstechnica.com/?p=1730785

As we’re waiting for word on the authorization of a second vaccine for use in the US, glitches have been striking the distribution of the first through the federal government’s “Operation Warp Speed.” This week, the US saw the first use of the vaccine developed by a Pfizer/BioNTech collaboration. But immediately afterward, many states started saying that orders for shipments in the ensuing weeks were being cut. After some in the federal government had indicated that the problem might be in production, Pfizer issued a statement indicating that it had doses in its warehouse ready to ship out but no indication of where to ship them to.

All in all, it’s about what you’d expect in the first weeks of a massive undertaking like this.

State of denial

One of the first states to report problems was Illinois, where its governor, J.B. Pritzker, said that it had indications it would only be receiving half the expected doses of the Pfizer/BioNTech vaccine next week. Since then, over a dozen states have indicated that they’ll be receiving fewer doses than planned in the second week (this article seems to have a fairly comprehensive list).

Aside from the obvious problem of fewer vaccinated people, this creates issues for states that are working through vaccinating a set of populations using risk-based priorities. For example, the availability of doses for health care workers will determine when vaccinations can be shifted to nursing home populations; planning on when to change the target population will be critical for a quick and effective shift. Without knowing when sufficient vaccines will be available, it’s much harder to manage these transitions.

When it comes to why the orders are being cut, we’re hearing multiple excuses. At a press conference on the distribution effort, Secretary of Health and Human Services Alex Azar pointed the finger at Pfizer, which is manufacturing the vaccine in the US. “We have recently been informed by them, finally, of various challenges that they might have in their manufacturing, and we will ensure that by whatever mechanism, that we provide them full support to ensure that they can produce for the American people,” Azar said.

But Azar’s isn’t the only story being given out by the government. The Washington Post was told that the issue was a matter of when the week’s doses were determined. Originally, that had been planned for Friday, when the full week’s manufacturing run had completed; it has since been shifted to Tuesday when fewer doses would be completed. That would necessarily cut down on the availability numbers given to states.

Unfortunately, neither of these seems to be entirely true. In response to this news, Pfizer has issued a statement in which it says it is having no production issues. “This week, we successfully shipped all 2.9 million doses that we were asked to ship by the U.S. Government to the locations specified by them,” the statement reads. “We have millions more doses sitting in our warehouse but, as of now, we have not received any shipment instructions for additional doses.”

Given that BioNTech joined up with Pfizer in part because of the latter’s manufacturing abilities and due to clear credibility issues with the Trump administration on the topic of COVID-19, it’s likely that Pfizer’s statement is closer to the truth.

Not all bad news

Warp Speed is a large and complex project in which multiple vaccine manufacturers will eventually be shipping doses to the federal government, which will then distribute them to states, each of which has to plan to get them to populations according to different priorities. It’s not at all surprising that there would be some growing pains. Hopefully, they can be ironed out while there’s a single vaccine supplier, which limits the complexity somewhat.

But the single supplier status may change as early as today, based on the decision of an FDA advisory board that a vaccine from Moderna is effective. Based on preliminary figures, Moderna expects that it will supply substantially more vaccine as soon as it receives a formal Emergency Use Authorization from the FDA, which will complicate distribution but ease supply bottlenecks.

Longer term, there are indications of other opportunities to increase vaccine supplies. After having declined an offer from Pfizer to purchase additional doses of the vaccine earlier this year, the federal government may be close to a deal to purchase more. Pfizer had worked with the suppliers of its raw materials to determine how much vaccine it could produce; when the US turned it down, the company simply found other countries to sell doses to. Now, it’s indicating that if the US government can ensure enhanced supply of its vaccine ingredients, it will sell the additional doses to the country.

As of right now, the US only has commitments to buy enough vaccine to cover half of its population by the middle of 2021, making additional doses essential. Last week, the government did manage to get a commitment from Moderna for another 100 million doses of its vaccine. Major pharmacy chains are expecting widespread availability this spring, indicating a confidence that additional supplies will be sorted out.

One small help for the present supply constraints that has become apparent this week is that the normal “overfill” found in vaccine bottles is sometimes enough to allow an extra dose to be extracted from a five-dose bottle of Pfizer vaccine. While it won’t handle the big-picture supply issues, it will undoubtedly help individual facilities get more of their staff protected in the early days of the vaccination program.

https://arstechnica.com/?p=1730750

Microsoft was hacked by the same group that compromised the networks of software maker SolarWinds and multiple federal agencies, Reuters reported, citing people familiar with the matter.

In response to the report, Microsoft said it had detected a backdoored version of SolarWinds software in its network, but had uncovered no evidence it was used to compromise the company’s production system or access customer data.

In a statement issued by Microsoft spokesman Frank X. Shaw, company officials wrote:

Like Other SolarWinds customers, we have been actively looking for indicators of this actor and can confirm that we detected malicious SolarWinds binaries in our environment, which we isolated and removed. We have not found evidence of access to production services or customer data. Our investigations, which are ongoing, have found absoltely no indications that our systems were used to attack others.

While the statement stopped short of saying no part of Microsoft’s network was compromised, it nonetheless challenged key parts of Reuters’ reporting.

Citing the same people, Reuters said that after the hackers breached Microsoft, they used Microsoft’s own products in follow-on hacks against others. It wasn’t immediately clear how many Microsoft users were affected or what Microsoft products were used. Microsoft representatives didn’t immediately return an email seeking comment.

Microsoft is just one of the recent additions to a rapidly growing list of victims in the wide-ranging and advanced hack that reportedly had the backing of the Russian government. Politico reported that the US Department of Energy and the National Nuclear Security Administration had evidence the same hackers accessed their networks. Bloomberg News said that three unidentified US states were hacked in the same campaign. The Intercept, meanwhile, said the hackers had been inside the city of Austin, Texas, for months.

The rapidly unfolding revelations further underscore the skill, discipline, and resources the hackers had at their disposal. In an alert issued earlier on Thursday, the Cybersecurity Infrastructure and Security Agency said the hacks posed a “grave risk”to US governments at all levels.

New details are likely to become available in the next hours. This story will be updated as warranted.

https://arstechnica.com/?p=1730611

Earlier this week, the FDA released documents that summarized the data on a second SARS-CoV-2 vaccine candidate, this one from a company called Moderna. That document was the background for a meeting of the FDA’s Vaccines and Related Biological Products Advisory Committee, which would consider whether the benefits of the vaccine outweigh its potential risks. That question is one of the key considerations for the agency as it decides whether to grant an emergency use authorization similar to the one it gave the Pfizer/BioNTech vaccine.

After an all-day meeting that frequently focused on other topics, the committee was near unanimous: 20 votes for approval, none against, and one abstention.

Emergency use authorizations have a number of requirements once a health emergency has been declared. There must be no alternatives that have achieved full FDA approval, there must be reasons to think that the treatment will be effective, and its benefits are considered likely to outweigh its risks. It’s that final question—the risk versus benefit balance—that the advisory committee was called to address.

To make that determination, the committee heard testimony from people involved in the clinical trial and other experts who evaluated the data. It also took public comment on the question. But the data was so promising that the committee spent most of its time debating what should happen to the trial participants once an emergency use authorization was granted. Those who received the placebo are expected to be immunized, but how that’s handled was a matter of extensive discussion.

Issues raised included the question of whether both vaccine and placebo groups should receive new injections in order to keep the study blinded and whether the placebo recipients should be given the vaccine as if they were prioritized along with the general population. Maintaining the trial long enough to get data from long-term safety monitoring may depend on how these issues are handled, but they’re secondary to the emergency use authorization.

Let’s do this!

When the vote finally came for that, it was decisive: 20 committee members voted that the benefits are likely to outweigh the risks, and a single person abstained. There were zero votes against the proposition.

The FDA still has to consider the other requirements for an emergency use authorization, but they’re unlikely to be major hurdles. While another vaccine has been approved for emergency use, nothing is at all close to having full FDA approval. And the same data that shows clear benefits would seem to handle the issue of there being reason to think the vaccine will be effective. In the case of the Pfizer/BioNTech vaccine, the FDA acted within 48 hours of the Advisory Committee’s thumbs-up, so we may have news before this weekend.

https://arstechnica.com/?p=1730576

Two separate coalitions of states have filed massive antitrust lawsuits against Google in the past 24 hours, alleging that the company abuses its extensive power to force would-be competitors out of the marketplace and harms consumers in the process.

Texas Attorney General Ken Paxton spearheaded the first suit, which nine other states also signed onto. The second suit is led by Colorado Attorney General Phil Weiser and Nebraska Attorney General Doug Peterson, and an additional 36 states and territories signed on.

Antitrust law isn’t just about a company being an illegal monopoly or even about being the dominant firm in its market sector. Although being a literal monopoly, with no available competition of any kind, can put you on the fast track to investigation, the law has broader concerns. Primarily, antitrust investigations are about anticompetitive behavior—in short, how a company uses its power. If you’re a big company because everyone likes your stuff best, well, you’re a big company, congratulations. But if you got to be the dominant company by cheating somehow—strong-arming other firms in the supply chain; targeting anticompetitive acquisitions; colluding with other firms to manipulate market conditions, and so on—that’s a problem.

With that in mind, let’s delve into what’s going on.

Wait—am I having déjà vu, or…

You have indeed heard this song before, and recently, too. Both new suits come in the wake of a suit the Justice Department and a group of 11 states—Arkansas, Florida, Georgia, Indiana, Kentucky, Louisiana, Mississippi, Missouri, Montana, South Carolina, and Texas—jointly filed against Google in October.

Three additional states also filed with the court today to join on to the federal case, so a total of 52 attorneys general—representing 49 states, Puerto Rico, Guam, and the District of Columbia—and the DOJ have now signed on to one or more of the three legal challenges. (Alabama appears to be the remaining state not yet participating in any of the cases at this time.)

For the time being, these two new lawsuits are separate and distinct both from the federal case and from each other. However, according to the DOJ, the coalition that filed its suit today also petitioned the court to consolidate the proceedings, so in all likelihood, this will eventually be one massive antitrust case.

What makes these new suits different from the first one?

The October suit is surprisingly narrow, considering how many segments of the digital marketplace Google’s parent company Alphabet either participates in or dominates. That case focuses almost entirely on Google’s search business, which the DOJ alleged the company monopolized illegally for more than a decade through “exclusionary agreements and anticompetitive conduct.” These both focus on other elements of Google’s business.

Such as… ?

The Texas-led suit (PDF) is focused on the online advertising market. According to that suit, Google uses its control of the advertising ecosystem to block potential competitors from competing in online advertising exchanges and unfairly uses its vertical integration to win realtime advertising auctions.

“Google is essentially trading on ‘insider information’ by acting as the pitcher, catcher, batter, and umpire, all at the same time” in the online advertising market, Paxton said when announcing the suit. “This isn’t the ‘free market’ at work here. This is anti-market and illegal under state and federal law.”

Google entered a series of agreements, codenamed Project Jedi, with other advertising firms to allow it to maintain its market share, the suit alleges. The most eye-popping of those deals is an agreement Google allegedly signed with Facebook in 2018, which “fixes prices and allocates markets between Google and Facebook as competing bidders in the auctions for publishers’ Web display and in-app advertising inventory.”

Basically, according to the suit, Facebook in 2017 figured out a way to make money from a new online-advertising bidding system. Google thought that new tactic posed an “existential threat” to its own massive slice of the advertising pie and made an agreement with Facebook: Facebook would cut back on the new tech, and Google would give Facebook a big edge in its own advertising auctions.

Tactics such as bid rigging and market division are explicitly, flatly illegal under antitrust law. “The Supreme Court has warned that there are such things as antitrust evils,” the suit begins, alleging that Google is guilty of such, and it “seeks to ensure that Google won’t be evil anymore.”

And the other suit?

The Colorado-led suit (PDF) focuses on Google’s search and search-advertising business, accusing the company of behaving anticompetitively in three key ways.

Firstly, the suit argues, Google “uses its massive financial resources to limit the number of consumers who use a Google competitor.” This holds particularly true in mobile, the suit alleges, which Google dominates entirely. Not only is Google the default search engine on Android, which is a Google product, but the company also pays Apple billions of dollars every year to be the default search engine on iOS devices as well.

Secondly, Google leverages its search-advertising business, SA360, in such a way as to prevent competition from arising, the suit alleges, by prohibiting interoperability with competitors and locking advertisers in. And thirdly, according to the suit, Google “throttles” those who try to go around Google to reach sites, products, and services directly. This harms “specialized vertical providers” by keeping them from reaching potential customers, especially on mobile.

What does Google have to say about this?

In response to the lawsuits, Google today published a lengthy corporate blog post explaining why Google search is Great, Actually, and should be left alone.

“Rigorous testing” has shown Google that consumers vastly prefer their search results to be chock-full of Google’s own modules, wrote Adam Cohen, Google’s director of economic policy. “We know that if you don’t like the results we’re giving you, you have numerous alternatives—including Amazon, Expedia, Tripadvisor and many others just a click away.”

Amazon, to consumers, is an e-retailer, streaming video company, and digital goods purveyor, not a search engine, and both Expedia and Tripadvisor are specifically for searches related to travel and hospitality, but it is indeed true that they exist.

The antitrust lawsuit “suggests we shouldn’t have worked to make Search better and that we should, in fact, be less useful to you,” Cohen added. “The claims being made have been closely examined and rejected by regulators and courts around the world, including the US Federal Trade Commission, competition authorities in Brazil, Canada, and Taiwan, and courts in the United Kingdom and Germany, who all agreed that our changes are designed to improve your search results. It’s also well established that the most important driver for our search results is the specific query—not your personal data.”

Google’s claims are accurate but misleading: while the FTC did back away from pursuing major action against Google in 2013, European regulators fined Google a total of more than $9 billion across three years for violating antitrust law: 2.4 billion euros ($2.7 billion) in 2017, related to search; 4.3 billion euros ($5 billion) in 2018, related to Android; and 1.5 billion euros ($1.7 billion) in 2019, related to AdSense. Regulators in several other nations such as Australia, Japan, India, and South Korea, are also reviewing Google’s competition practices.

What next?

The potential outcomes of these cases are unclear. We could be looking at the biggest antitrust action in a generation, a giant nothingburger, or anything in between.

None of the three cases specifically calls for Google to be broken up, unlike the Facebook antitrust lawsuits the feds and states filed last week. That said, they don’t exactly not seek breakups either. Instead, the suits are all calling for whatever “structural relief” might be deemed necessary alongside all the various fines, penalties, and injunctions against bad behavior they seek.

It’s going to be a very long, very ugly legal fight, no matter what happens. Even if the cases are consolidated into a single docket, as seems likely, don’t be surprised if it takes until 2025 or beyond for the case to wrap once and for all. For comparison, the DOJ filed its landmark antitrust case against Microsoft in May 1998; the court accepted what became the final settlement in November 2002, 4.5 years later.

https://arstechnica.com/?p=1730341

The supply chain attack used to breach federal agencies and at least one private company poses a “grave risk” to the United States, in part because the attackers likely used means other than just the SolarWinds backdoor to penetrate networks of interest, federal officials said on Thursday. One of those networks belongs to the National Nuclear Security Administration, which is responsible for the Los Alamos and Sandia labs, according to a report from Politico.

“This adversary has demonstrated an ability to exploit software supply chains and shown significant knowledge of Windows networks,” officials with the Cybersecurity Infrastructure and Security Agency wrote in an alert. “It is likely that the adversary has additional initial access vectors and tactics, techniques, and procedures (TTPs) that have not yet been discovered.” CISA, as the agency is abbreviated, is an arm of the Department of Homeland Security.

Elsewhere, officials wrote: “CISA has determined that this threat poses a grave risk to the Federal Government and state, local, tribal, and territorial governments as well as critical infrastructure entities and other private sector organizations.”

Reuters, meanwhile, reported that the attackers breached a separate major technology supplier and used the compromise to get into high-value final targets. The news services cited two people briefed on the matter.

The attackers, whom CISA said began their operation no later than March, managed to remain undetected until last week when security firm FireEye reported that hackers backed by a nation-state had penetrated deep into its network. Early this week, FireEye said that the hackers were infecting targets using Orion, a widely used network management tool from SolarWinds. After taking control of the Orion update mechanism, the attackers were using it to install a backdoor that FireEye researchers are calling Sunburst.

Sunday was also when multiple news outlets, citing unnamed people, reported that the hackers had used the backdoor in Orion to breach networks belonging to the Departments of Commerce, Treasury, and possibly other agencies. The Department of Homeland Security and the National Institutes of Health were later added to the list.

Bleak assessment

Thursday’s CISA alert provided an unusually bleak assessment of the hack; the threat it poses to government agencies at the national, state, and local levels; and the skill, persistence, and time that will be required to expel the attackers from networks they had penetrated for months undetected.

“This APT actor has demonstrated patience, operational security, and complex tradecraft in these intrusions,” officials wrote in Thursday’s alert. “CISA expects that removing this threat actor from compromised environments will be highly complex and challenging for organizations.”

The officials went on to provide another bleak assessment: “CISA has evidence of additional initial access vectors, other than the SolarWinds Orion platform; however, these are still being investigated. CISA will update this Alert as new information becomes available.”

The advisory didn’t say what the additional vectors might be, but the officials went on to note the skill required to infect the SolarWinds software build platform, distribute backdoors to 18,000 customers, and then remain undetected in infected networks for months.

“This adversary has demonstrated an ability to exploit software supply chains and shown significant knowledge of Windows networks,” they wrote. “It is likely that the adversary has additional initial access vectors and tactics, techniques, and procedures that have not yet been discovered.”

Among the many federal agencies that used SolarWinds Orion, reportedly, was the Internal Revenue Service. On Thursday, Senate Finance Committee Ranking Member Ron Wyden (D-Ore.) and Senate Finance Committee Chairman Chuck Grassley (R-Iowa) sent a letter to IRS Commissioner Chuck Rettig asking that he provide a briefing on whether taxpayer data was compromised.

They wrote:

The IRS appears to have been a customer of SolarWinds as recently as 2017. Given the extreme sensitivity of personal taxpayer information entrusted to the IRS, and the harm both to Americans’ privacy and our national security that could result from the theft and exploitation of this data by our adversaries, it is imperative that we understand the extent to which the IRS may have been compromised. It is also critical that we understand what actions the IRS is taking to mitigate any potential damage, ensure that hackers do not still have access to internal IRS systems, and prevent future hacks of taxpayer data.

IRS representatives didn’t immediately return a phone call seeking comment for this post.

The CISA alert said the key takeaways from its investigation so far are:

• This is a patient, well-resourced, and focused adversary that has sustained long duration activity on victim networks
• The SolarWinds Orion supply chain compromise is not the only initial infection vector this APT actor leveraged
• Not all organizations that have the backdoor delivered through SolarWinds Orion have been targeted by the adversary with follow-on actions
• Organizations with suspected compromises need to be highly conscious of operational security, including when engaging in incident response activities and planning and implementing remediation plans

What has emerged so far is that this is an extraordinary hack whose full scope and effects won’t be known for weeks or even months. Additional shoes are likely to drop early and often.

https://arstechnica.com/?p=1730464

With the worst of a storm of misinformation—and disinformation—about the 2020 US presidential election behind us, both Facebook and Twitter are relaxing some emergency measures put in place to limit its spread.

Twitter brings back one-click retweets

The most obvious changes taking place are on Twitter, which is getting rid of a measure it put in place in October to encourage quote tweeting (QT) instead of simple retweeting (RT). The intent was to encourage users to add thoughtful commentary and perhaps to actually read original content prior to amplifying it based on a headline alone.

Our goal with prompting QTs (instead of Retweets) was to encourage more thoughtful amplification. We don’t believe that this happened, in practice. The use of Quote Tweets increased, but 45% of them included single-word affirmations and 70% had less than 25 characters. The increase in Quote Tweets was also offset by an overall 20% decrease in sharing through both Retweets and Quote Tweets. Considering this, we’ll no longer prompt Quote Tweets from the Retweet icon.

Twitter verification is coming back in 2021

The company is also relaunching its somewhat-controversial verification process—the measure by which one gets a blue checkmark next to one’s username on each tweet. The company put the verification process on hold in November 2017, acknowledging issues with perception of verified accounts as endorsed by Twitter. Since then, already-verified accounts have kept the blue check, but few if any new accounts—even those meeting earlier criteria for verification—have been accepted.

Three weeks ago, Twitter asked for public input on a new verification process, and today it has announced plans for the renewed verification program, available in 2021. Not much appears to have truly changed about the program or the process of becoming enrolled—highlights include the “News” category becoming “News and Journalists,” and “Sports” becoming “Sports and esports.”

There are a few other changes, such as tweaks to the methods in which follower count is measured for accounts which need to meet a certain barrier for verification—but for the most part, the news here seems to be more “verification will be a thing again” rather than any major updates to what verification means or how it works.

Facebook decreases boost for “authoritative” news sources

Facebook’s newsfeed algorithm constantly decides what items to prioritize or deprioritize, using a set of metrics designed to increase user engagement. Several days after the November election, it increased the priority of a metric it calls the NEQ score, for News Ecosystem Quality.

Pumping up the NEQ’s impact was part of Facebook’s “emergency, break glass” plan intended to react to massively increased levels of misinformation as popular votes from the presidential election were still being counted. The increased priority boosted traffic for mainstream news publishers such as CNN, NPR, or The New York Times, while decreasing traffic for partisan sites like Breitbart or Occupy Democrats.

According to The New York Times, some Facebook employees asked if the resulting “nicer newsfeed” could be a permanent fixture. But according to Facebook executive Guy Rosen, the changes were always meant to be temporary. “This was a temporary change we made to help limit the spread of inaccurate claims about the election,” continued Facebook spokesperson Joe Osborne. “We’re still ensuring that people see authoritative and informative news on Facebook, especially during major news cycles and around important global topics like elections, Covid-19, and climate change.”

https://arstechnica.com/?p=1730421

Forty Jane Does who say they were victims of GirlsDoPorn sued Pornhub yesterday for at least $2 million each, alleging that Pornhub hosted videos despite knowing that “GirlsDoPorn was a sex trafficking venture.”

The lawsuit was filed against Pornhub and Pornhub owner MindGeek in US District Court for the Southern District of California. The complaint asks for “compensatory damages in an amount that exceeds one million dollars for each plaintiff,” plus another $1 million or more, each, in punitive damages.

While they were separate businesses, many of the videos produced by GirlsDoPorn were uploaded to and hosted on Pornhub. The lawsuit alleges that “as early as 2009, and definitely by fall 2016, MindGeek knew GirlsDoPorn was trafficking its victims by using fraud, coercion, and intimidation as part of its customary business practices to get the women to film the videos.”

The complaint continues:

Despite this knowledge, MindGeek continued to partner with GirlsDoPorn, never bothering to investigate or question its business partner regarding the mounting evidence of sex trafficking that MindGeek received. MindGeek continued its partnership with GirlsDoPorn until October 2019 when the Department of Justice shut down GirlsDoPorn by arresting and indicting its principals. At this point, there was no longer a company left for MindGeek to partner with.

“Please im begging you”

The lawsuit further alleges that MindGeek refused to remove videos despite requests from GirlsDoPorn victims, and it gave examples involving two of the plaintiffs. The complaint says that, in August 2016, one of the Jane Doe plaintiffs submitted a takedown request through Pornhub’s takedown portal in which she wrote, “Im going to kill myself if this stays up here. I was scammed and told this was only going to be on dvds in another country. Please im begging you please ill pay!”

She sent a second request that month asking MindGeek to remove the video from Tube8.com, another MindGeek property, the lawsuit said. Her third takedown request came in May 2017 “after MindGeek continued to publish her video on PornHub.com,” the complaint said.

Besides Pornhub, the GirlsDoPorn videos were also hosted on other MindGeek properties referred to as “Tubesites” in the lawsuit. Jane Doe’s video remained “on MindGeek’s Tubesites until after GirlsDoPorn’s principals were arrested in October 2019 when MindGeek finally decided to take action,” the complaint said.

Another one of the Jane Doe plaintiffs in January 2016 “submitted a content removal request to MindGeek, begging to have her video removed because of the lack of consent and harassment she was under,” the complaint said.

“These are just some of many examples of takedown requests MindGeek received notifying MindGeek that GirlsDoPorn used fraud and coercion to get the women to engage in commercial sex acts and the corresponding harassment and suicidal tendencies the victims had as a result of the continued publication of the video,” the complaint said. “Plaintiffs have been informed and believe MindGeek received dozens, if not hundreds, of similar takedown requests from GirlsDoPorn victims over the years and never conducted an investigation of the repeated claims of fraud or coercion perpetrated by its content and viewshare partner, GirlsDoPorn.”

Describing the “partnership” in more detail, the lawsuit said that “from at least 2011 until the end of 2019, MindGeek contracted with GirlsDoPorn to be partners in MindGeek’s Content Partner Program and Viewshare Program. In so doing, MindGeek created dedicated channels for GirlsDoPorn’s videos on MindGeek’s Tubesites containing trailer versions of the victim’s videos.”

Criminal charges

In January, a California judge ordered GirlsDoPorn’s operators to pay nearly $13 million to 22 women who were tricked and coerced into shooting pornographic videos. The GirlsDoPorn website went offline shortly after that ruling.

The FBI is still searching for GirlsDoPorn creator Michael Pratt, who faces criminal sex-trafficking and child-porn charges. Charges were also filed against other GirlsDoPorn principals including Ruben Andre Garcia and Matthew Wolfe.

“Garcia pled guilty to sex trafficking under Section 1591 and conspiracy to commit sex trafficking for his role in the GirlsDoPorn sex trafficking venture,” the Jane Does’ lawsuit said. “Garcia is set to be sentenced by the Honorable Janis L. Sammartino in the coming months. Wolfe remains in federal custody in San Diego awaiting trial. Pratt is still at large.”

Pornhub removed millions of videos

Pornhub has faced increasing problems amid allegations that it hosted content featuring child sexual exploitation, nonconsensual violence, rape, and other illegal material. Visa and MasterCard banned Pornhub from their payment platforms last week. Pornhub has responded to the controversy by banning uploads by unidentified users and purging millions of user-uploaded videos.

At least some of the Jane Does’ videos were still on MindGeek sites this month, the complaint said:

Even after severing its partnership with GirlsDoPorn, MindGeek continues to profit from Plaintiffs’ videos to this day. As of December 12, 2020, MindGeek still hosts victims’ videos on its websites, including Plaintiffs. The URLs for the victims’ videos contain affiliate tails and are surrounded by hyperlink advertisements that, if clicked, redirect the visitors to various paysites. Most of the hyperlink advertisements on these victim’s videos redirect the visitor to MindGeek’s paysite, www.Brazzers.com. Others redirect the visitor to third-party paysites, such as JerkMate.com.

Pornhub’s purge of millions of videos, presumably including many of the videos in which the plaintiffs appeared, was announced on December 14.

Section 230 and FOSTA

The plaintiffs are seeking damages under Section 1595 of US law, which lets victims of trafficking bring civil actions against either perpetrators or people who benefit when they “knew or should have known” about the crimes.

MindGeek’s defense against the lawsuit could cite Section 230 of the Communications Decency Act, which gives legal immunity to online platforms that host user-submitted content. But the lawsuit argues that the Fight Online Sex Trafficking Act (FOSTA) enacted in 2018 would override a Section 230 defense.

The plaintiffs acknowledge that a 2015 court decision “provided immunity to online companies for Section 1595 lawsuits even if the company knowingly assisted sex traffickers.” But because of FOSTA, “Section 230 now states it shall have ‘[n]o effect on sex trafficking law,’ and shall not ‘be construed to impair or limit… any claim in a civil action brought under section 1595 of title 18, if the conduct underlying the claim constitutes a violation of section 1591 of that title,'” the lawsuit said. The complaint also noted that the change to Section 230 is retroactive.

The lawsuit claims that MindGeek is liable even if it did not know about the sex trafficking, saying:

If MindGeek did not know GirlsDoPorn was a sex trafficking venture before October 2019, it should have known for a great number of reasons, the most notable of which is that GirlsDoPorn’s victims sent MindGeek complaints detailing the fraud and coercion they were subjected to by GirlsDoPorn. Because of this knowledge, MindGeek is, at minimum, civilly liable to Plaintiffs under Section 1595 for damages and attorney fees. And if MindGeek truly did not know that its GirlsDoPorn was using fraud, intimidation, and coercion are part of its regular business practices until the criminal charges were filed in October 2019, MindGeek’s ignorance of the sex trafficking is a direct result of its own negligence, which still triggers Section 1595 liability.

We contacted MindGeek about the Jane Does’ lawsuit and will update this article if we get a response.

https://arstechnica.com/?p=1730189

The price of one bitcoin rose above $20,000 on Wednesday. The new all-time record caps a year of gains for the world’s most valuable cryptocurrency. The value of all bitcoin in circulation is now around $380 billion.

No single event seems to have pushed bitcoin’s value over the $20,000 mark. But more and more companies, institutions, and wealthy individuals have started to see it as a worthwhile long-term investment, driving demand upward.

A software company called MicroStrategy has poured hundreds of millions of dollars into bitcoin in recent months. It recently announced it was raising another $400 million to buy bitcoin.

Square announced a $50 million bitcoin investment in October. The same month, PayPal announced support for bitcoin, providing an on-ramp for retail investors.

Boosters see bitcoin as digital gold

We’re now in the fourth major boom bitcoin has experienced since it was created in 2009. Bitcoin reached its previous peak around $19,500 in December 2017 before crashing to a low around $3,200 a year later.

In bitcoin’s early years, bitcoin boosters positioned it as a new payment technology, emphasizing its ability to clear transactions in minutes with near-zero transaction fees. But that vision didn’t pan out. While it’s fairly easy for a merchant to accept bitcoins, acquiring bitcoins for routine transactions continued to be a hassle. Moreover, the capacity of the bitcoin network failed to keep up with rising demand, leading to skyrocketing fees and long wait times at the tail end of the last bitcoin boom in 2017.

As a result, many people today see bitcoin as primarily an investment asset. People don’t buy bitcoins because they want to make payments with it. They buy it in the hopes that its value will continue rising.

That might seem paradoxical. Most assets—stocks, bonds, real estate—are valued based on the income they generate. But not all assets are like that. Gold doesn’t generate any dividends, yet the world’s gold stocks are collectively worth trillions of dollars. Bitcoin investors are betting the same will be true of cryptocurrency in the long run.

And this is increasingly looking like a winner-take-all market. Bitcoin’s price is now above its previous high from 2017. But other leading cryptocurrencies have not regained their previous highs. The number two cryptocurrency, Ethereum’s ether, is worth around $600, less than half the peak reached in early 2018. Bitcoin Cash, a bitcoin spinoff designed to enable higher transaction volumes, has lost 90 percent of its value since its late 2017 peak. Litecoin is down about 70 percent over three years.

https://arstechnica.com/?p=1730141