The California Public Utility Commission has slapped Uber with a $59 million fine for refusing to hand over detailed records about more than 1,200 alleged sexual assaults involving Uber drivers in California between 2017 and 2019.

“The CPUC has been insistent in its demands that we release the full names and contact information of sexual assault survivors without their consent,” Uber said in a Monday statement. “We opposed this shocking violation of privacy, alongside many victims’ rights advocates.”

Uber disclosed the existence of thousands of sexual assaults nationwide in its 2019 safety report. Afterward, the CPUC demanded detailed information about cases that occurred in California—including the time and place where assaults happened and names and contact information of witnesses. The CPUC order doesn’t specifically ask for the names of victims. However, in many cases the victim would be the only witness, so CPUC was essentially seeking to unmask hundreds of sexual assault victims.

Uber objected, noting that most of the victims had not consented to have their identities or stories shared with third parties. Even if the records were kept confidential, Uber argued, a CPUC investigation of these cases could force victims to revisit one of the most traumatic moments in their lives.

In a revised order, the CPUC allowed Uber to submit the information under seal to ensure that the data did not become public. But beyond that, the CPUC refused to budge, issuing a second order in January demanding that Uber turn over the data.

“Re-traumatization of victims”

Victims’ rights groups like the Rape Abuse Incest National Network (RAINN) rallied to Uber’s defense. “RAINN is exceedingly concerned that the Commission’s ruling” directs Uber to “share a list of victim names, contact information, and additional incident details with the Commission, without the consent of the victims,” the group wrote in an August filing with the CPUC.

“The vast majority of sexual assault victims choose not to report to police,” RAINN added. “Surely, they never envisioned that a state regulatory commission would require disclosure of information that they, themselves, have explicitly decided to not share with the state.”

RAINN argued that enforcement of the CPUC’s demands would “nullify each victim’s right to decide when, and to whom, to disclose their assault” and would “risk re-traumatization of victims.”

But the CPUC seemed unmoved by these arguments, whether they came from Uber or from groups like RAINN. In a Monday ruling, the agency held that “this decision does not require the public disclosure of such information that could potentially traumatize the victims a second time.” Instead, the agency reasoned, the rules “require only that the information regarding sexual assaults and sexual harassment be submitted to the Commission under seal.”

The CPUC concluded that Uber had “refused, without any legitimate legal or factual grounds, to comply” with the data request. The agency held that Uber’s actions were particularly severe because they had “harmed the regulatory process.”

In setting a fine, the CPUC is supposed to consider whether a party’s actions were in the public interest. But in Uber’s case, the agency concluded that “there are no facts to mitigate the degree of Uber’s wrongdoing.” So the CPUC slapped Uber with a harsh $59 million penalty.

“Transparency should be encouraged”

Ironically, after hitting Uber with a massive fine for refusing to name sexual assault victims, the ruling allows Uber to submit its data in anonymized form.

“Uber shall work with the Commission’s staff to develop a code or numbering system as a substitute for the actual names and other personally identifiable information” of victims and witnesses to assault cases, the ruling said.

Uber seems to be the only taxi or ride-hailing service that has faced these kinds of questions from the CPUC. The company’s decision to publish statistics about sexual assault and other crimes against its passengers set a new standard for transparency, but the report seems to have attracted extra scrutiny from California regulators.

“These punitive and confusing actions will do nothing to improve public safety and will only create a chilling effect as other companies consider releasing their own reports,” Uber said in its statement. “Transparency should be encouraged, not punished.”

https://arstechnica.com/?p=1729950

A Republican US senator from West Virginia has asked the government to block broadband funding earmarked for Frontier Communications, saying that the ISP is not capable of delivering gigabit-speed Internet service to all required locations.

Sen. Shelley Moore Capito (R-W.Va.) outlined her concerns in a letter to Federal Communications Commission Chairman Ajit Pai last week. Capito told Pai that Frontier has mismanaged previous government funding and seems to lack both the technological capabilities and financial ability to deliver on its new obligations.

Frontier, which filed for bankruptcy in April, is one of 180 ISPs that won funding in the FCC’s Rural Digital Opportunity Fund (RDOF) reverse-auction results announced last week. Frontier is due to receive $370.9 million over 10 years to bring broadband to 127,188 homes and businesses in eight states. Frontier’s biggest payout is in West Virginia, where it is due to receive $247.6 million over 10 years to expand its broadband network to 79,391 locations.

Frontier won over two-thirds of the funding that the FCC allocated to West Virginia despite failing to hit FCC deadlines for a previous round of subsidized broadband deployment in West Virginia and other states. Under the previous funding allocated in 2015 via the FCC’s Connect America Fund, Frontier was originally required to meet the build deadlines by the end of 2020. Frontier told Ars today that it will now meet that deadline “by the end of 2021.”

“Pattern” of missing deadlines

Capito urged Pai to block Frontier’s new funding by rejecting the ISP’s long-form application, which must be completed by winning bidders in order to receive the allocated money. “The stakes are simply too high to provide nearly $250 million to a company that does not have the capability to deliver on the commitments made to the FCC,” she wrote.

Under FCC rules, winning bidders must deploy broadband to 40 percent of required locations in each state within three calendar years, to 60 percent within four years, 80 percent within five years, and 100 percent within six years. Because Frontier won funding in the gigabit tier, it is required to offer download speeds of 1Gbps and upload speeds of 500Mbps along with monthly usage allowances of at least 2TB.

Capito described her reasons for concern about Frontier’s ability to meet the requirements as follows:

Frontier’s mismanagement of prior federal funding through the Broadband Technology Opportunity Fund program, resulting in $4.7 million in funds repaid to the federal government for improper use, raises significant questions about their ability to manage federal funds of this magnitude. Furthermore, Frontier has a documented pattern of history demonstrating inability to meet FCC deadlines for completion of Connect America Fund Phase II support in West Virginia. The inability to deploy federal funds in a timely fashion to make improvements to a network delivering broadband service at speeds of 10/1Mbps or higher should raise significant concerns about their capacity to build out a network delivering one hundred times that level.

Specifically with regards to Frontier’s assigned performance tier, I urge you to exert the utmost scrutiny to ensure they have the technological capability to deliver gigabit level service in West Virginia. As stated in the Federal Register dated June 18, 2020, the FCC reserves the right to reject an applicant’s long-form application if they do not meet the technical qualifications for the performance tier in which they were permitted to bid. Based on Frontier’s current and previous performance, I am concerned they lack the technological capabilities in West Virginia to transition from a provider that struggles to deliver the FCC minimum standard of 25/3Mbps to a provider that is able to provide gigabit level service to 95 percent of the required number of locations in the state.

In April, we wrote about an audit report ordered by the West Virginia Public Service Commission, which found that Frontier’s “copper network has at least 952,163 connection points that are susceptible to moisture, corrosion, loose connections, etc. that may cause interruptions of service to customers.” The report also found that Frontier repeatedly failed to meet a service-quality benchmark that 85 percent of outages should be fixed within 48 hours. Frontier has about 300,000 customers in West Virginia, most of whom subscribe to DSL Internet service.

When contacted by Ars today, a Frontier spokesperson said that “due to quiet period regulations,” the company “cannot comment beyond what has been made publicly available by the FCC.” Frontier told the FCC it would use fiber-to-the-home to deliver gigabit speeds and will have to provide more detail on its network and funding plans in the long-form application.

We contacted the FCC about Capito’s letter today and will update this article if we get a response.

Frontier’s bankruptcy

Frontier’s bankruptcy also worries Capito. As the FCC subsidies apparently won’t cover the full cost of deployment, she wrote that Frontier “would need to raise over $250 million in private capital to fund the buildout of a gigabit network in West Virginia.”

Nationwide, the FCC awarded $9.2 billion to ISPs despite initially making $16 billion available. The reverse auction format resulted in lower payouts because ISPs compete for the funding. Capito wrote to Pai:

I urge you to closely scrutinize the financial capability of Frontier to finance these investments, particularly as they emerge from a Chapter 11 financial restructuring. Because of the nature of a reverse auction, it is entirely possible, if not likely that a bidder will be required to invest their own funds to cover costs above and beyond the subsidy provided by RDOF. Emerging from a financial restructuring requires significant private capital and I am concerned about the ability of Frontier to raise sufficient capital to both complete their financial restructuring and fund the construction of a network that will deliver the required gigabit level service in the locations they successfully bid in the RDOF auction. The expense of constructing a network capable of delivering gigabit service is an expensive and daunting feat for a company in a strong financial position, let alone one that is in financial turmoil.

At the time of its bankruptcy, Frontier acknowledged to investors that its “significant under-investment in fiber deployment” contributed greatly to the company’s decline. Frontier has also faced investigations and complaints of chronic outages in New York, Minnesota, and Ohio.

Derek Turner, research director at advocacy group Free Press, is skeptical about Frontier’s ability to deploy fiber-to-the-premises (FTTP) in remote areas. “Can Frontier handle FTTP deployment at this scale in rural areas? I can’t say; what I can say is that they bought most of their existing FTTP assets from Verizon, so their deployment track record is limited,” Turner told Ars today. Turner has also criticized the FCC for awarding much of the RDOF funding to various ISPs in wealthy urban areas.

“I think the state is going to get screwed”

Capito is not the only official from West Virginia who has objected to Frontier getting federal money, as shown in a West Virginia Public Broadcasting report last week. Mike Holstine, secretary-treasurer of the West Virginia Broadband Enhancement Council, called Frontier’s new funding “unbelievable.”

“‘I think the state is going to get screwed again,’ [Holstine] said, referencing the Broadband Technology Opportunities Program scandal in which West Virginia was forced to return nearly $5 million in federal funds in 2017 after regulators discovered Frontier had wasted it,” the news report said.

Frontier has said it expects to emerge from Chapter 11 bankruptcy in early 2021. Besides West Virginia, Frontier also won FCC funding in California, Connecticut, Florida, Illinois, New York, Pennsylvania, and Texas.

In May, Frontier completed a sale of its Northwest US operations to a newly formed ISP called Ziply Fiber. Ziply, referred to as Frontier Communications Northwest in FCC filings, participated in the RDOF auction and won funding in Idaho, Montana, Oregon, and Washington state.

https://arstechnica.com/?p=1729949

The Federal Trade Commission is stepping up its digital privacy work and has asked just about every major social media platform you can think of to explain what personal data it collects from users and why.

The requests for information went out today to nine platforms (or their parent companies, where applicable), including Discord, Facebook, Reddit, Snapchat, TikTok, Twitch, Twitter, WhatsApp, and YouTube, according to the press release. The companies that receive the orders have 45 days to explain to the FTC:

• How social media and video streaming services collect, use, track, estimate, or derive personal and demographic information
• How they determine which ads and other content are shown to consumers
• Whether they apply algorithms or data analytics to personal information
• How they measure, promote, and research user engagement
• How their practices affect children and teens

A sample order (PDF) shows the depth and specificity of the information the FTC is requesting from each firm, including extremely granular data about monthly and daily active users, business and advertising strategies, and potential plans for acquisitions or divestments. Interestingly, each firm is also required to say how many users it has inaccurate demographic information for and how it accounts for targeted advertising, including inaccurately targeted advertising. In other words, among other things the FTC wants to know: do you give advertisers their money back if you don’t actually target the groups they’re trying to reach?

The investigations are not part of any specific wrongdoing probe… at least, not right now. Under Section 6(b) of the FTC Act, the commission has authority to conduct certain kinds of wide-ranging studies, not tied to a specific law enforcement proceeding or suspicion. The review of Big Tech’s smallest acquisitions, which the FTC began in February, is another 6(b) study.

The commission voted 4-1 in favor of beginning the study. Three commissioners—Rohit Chopra, Rebecca Slaughter, and Christine Wilson—issued a joint statement (PDF) in support of the investigation.

“Social media and video streaming services have become almost unavoidable in today’s modern world,” particularly in the socially distanced pandemic era, the commissioners wrote. “Despite their central role in our daily lives, the decisions that prominent online platforms make… remain shrouded in secrecy. Critical questions about business models, algorithms, and data collection and use have gone unanswered.

“Never before has there been an industry capable of surveilling and monetizing so much of our personal lives,” the commissioners continued. To that end, the 6(b) study is “a step toward getting much-needed clarity” about what the firms all do, how, and why.

Commissioner Noah Phillips, who voted against the study, issued a separate dissent (PDF).

The orders are “an undisciplined foray into a wide variety of topics, some only tangentially related to the stated focus of this investigation,” Phillips said, arguing that the probe was a waste of FTC resources and would not provide the public with valuable information or address issues of consumer privacy.

“Special attention to children”

Massachusetts Sen. Edward Markey (D-Mass.) issued a statement in support of the investigation. “No comprehensive investigation of these websites would be complete without special attention to children and teens, a uniquely vulnerable population online,” Markey said. “I am glad that the FTC heeded my calls to issue these orders, and I thank my bipartisan partners who joined me in advocating for this investigation.”

Markey, together with Sen. Richard Blumenthal (D-Conn.) introduced a bill back in March that would specifically address the “non-transparent ways” digital media apps and platforms market to and collect information from users ages 16 and under.

https://arstechnica.com/?p=1729727

The Federal Communications Commission last week awarded $9.2 billion to 180 broadband providers, saying the money will bring Internet access to 5.2 million “unserved” homes and businesses in rural areas across the United States. But consumer advocates say they’ve found major problems in the FCC’s funding choices, such as sending money to wealthy urban areas that are adjacent to high-speed networks. SpaceX is among the biggest beneficiaries of the funding decisions that have drawn criticism.

FCC Chairman Ajit Pai is “subsidiz[ing] broadband for the rich,” according to the title of an analysis last week by Derek Turner, research director at advocacy group Free Press. Turner has a strong track record analyzing FCC broadband data and last year found major errors in Pai’s broadband-deployment claims.

Pai’s priority seems to be “closing the golf-course and parking-lot digital divide,” Turner wrote. The FCC’s Rural Digital Opportunity Fund—despite its name—is devoting a significant portion of its money to urban and suburban areas, he wrote. While there are broadband shortages in urban areas, Turner argues that some of the FCC money is going to urban areas that existing cable or fiber ISPs could serve with just minor extensions of their existing networks.

The $9.2 billion for all ISPs is being distributed over 10 years, making the annual payout $920 million.

SpaceX wins money in surprising places

Turner published a follow-up blog post today focusing on SpaceX, which is receiving $885.51 million over 10 years to provide Starlink broadband to 642,925 homes and businesses in 35 states. Free Press estimates “that nearly 13 percent of the money awarded to Starlink—$111 million—is to provide service in urban areas.” Across all 180 funded ISPs, “more than $700 million of the $9.2 billion in subsidies were awarded to ISPs for deployment in non-rural areas,” Turner wrote.

SpaceX CEO Elon Musk has said Starlink is targeted at rural areas and “will serve the hardest-to-serve customers that telcos otherwise have trouble” reaching. While SpaceX did get FCC funding for plenty of rural areas, it also won “the right to serve a large number of very urban areas that the FCC’s broken system deemed eligible for awards,” Turner wrote. For example, Turner wrote that SpaceX won broadband subsidies in locations at or adjacent to major airports in Atlanta, Chicago, Denver, New York City, Seattle, Las Vegas, Newark, Miami, Boston, Minneapolis-Saint Paul, Fort Lauderdale-Hollywood, Detroit, and Philadelphia.

Turner’s post is filled with examples such as this one, which shows that SpaceX received funding to serve the Miami International Airport and adjacent areas:

SpaceX won funding in other surprising places such as “the Jersey City Target store”; census blocks “with luxury hotels” in Chicago; “empty parking lots, grassy fields and highway medians” near Washington, DC; a “parking garage in downtown Miami Beach, two blocks from the beach, surrounded on all sides by multiple companies offering gigabit service”; and a street in San Francisco “that borders the southern edge of Golden Gate Park.” SpaceX is also getting funding to serve “a parking lot outside the Pentagon,” according to Turner.

FCC rules “created a broken system”

The RDOF and other universal service programs run by the FCC are paid for by Americans through fees imposed on phone bills. According to rules set by the FCC, the entire $9.2 billion must fund deployment only in census blocks where no ISPs report offering service with at least 25Mbps download and 3Mbps upload speeds.

But census blocks are small, and blocks that are counted as unserved “may be surrounded on all sides by fiber,” Turner told Ars via email. “That’s because of an important design flaw in the FCC’s mapping system: ISPs are [required] to report the blocks where they currently offer service or could without extraordinary use of resources within a 10-day period. Thus a block can show up as ‘unserved’ even though it isn’t any more expensive than any typical block to serve; it just means an ISP didn’t claim the block.”

SpaceX “appears to have played by the rules. But the FCC’s rules created a broken system,” Turner wrote in his post on the Free Press site. “By bidding for subsidies assigned to dense urban areas, Musk’s firm and others were able to get potentially hundreds of millions in subsidies meant for people and businesses in rural areas that would never see broadband deployment without the government’s help.”

We contacted SpaceX about Free Press’s post today and will update this article if we get a response. SpaceX has not said whether it will use the FCC money to lower Starlink prices in funded areas or if the money will simply help pay for the network’s deployment costs.

“Another Hyperloop-style boondoggle”

“If Musk needed that much of our subsidy money to make his rural-only operation viable, he should have bid on rural blocks in the areas he intends to serve,” Turner wrote. “That he didn’t suggests three possibilities: He either couldn’t win the reverse auction for those areas outright (meaning another company will get FCC subsidy money to serve them while Starlink covers them too); that this is just another Hyperloop-style boondoggle; or that the auction was so rushed that companies like Starlink didn’t even know what they were bidding on. None of these explanations are acceptable.”

Universal service funding is a “zero-sum world” in which every wasted dollar is “one less dollar that could go to connecting the nearly 80 million people who can’t afford home Internet,” Turner wrote. The point of the RDOF “is to offer the subsidy needed to ensure broadband is built in places where the deployment costs are so high that deployment is not feasible,” he told Ars. But the FCC’s census-block standard does not ensure that funding is limited to such areas, he said.

https://arstechnica.com/?p=1729743

About 18,000 organizations around the world downloaded network management tools that contained a backdoor that a nation state used to install malware that stole sensitive data, the tools provider, SolarWinds, said on Monday.

The disclosure from Austin, Texas-based SolarWinds, came a day after the US government revealed a major security breach hitting federal agencies and private companies. The US Departments of Treasury, Commerce, and Homeland Security departments were among the federal agencies on the receiving end of hacks that gave access to email and other sensitive resources. Federal agencies using the software were instructed on Sunday to disconnect systems that run the software and perform a forensic analysis of their networks.

Security firm FireEye, which last week disclosed a serious breach of its own network, said that hackers backed by a nation-state compromised a SolarWinds software update mechanism and then used it to infect selected customers who installed a backdoored version of the company’s Orion network management tool.

The backdoor infected customers who installed an update from March to June of this year, SolarWinds said in a document filed on Monday with the Securities and Exchange Commission. SolarWinds, which said it has about 300,000 Orion customers, put the number of affected customers at about 18,000.

Stealing the master keys

Several factors made Orion an ideal stepping stone into networks coveted by Russia-backed hackers, who over the past decade have become one of the most formidable threats to US cyber security. Mike Chapple, a teaching professor of IT, Analytics, and Operations at the University of Notre Dame, said the tool is widely used to manage routers, switches, and other network devices inside large organizations. The level of privileged access coupled with the number of networks exposed made Orion the perfect tool for the hackers to exploit.

“SolarWinds by its nature has very privileged access to other parts of your infrastructure,” Chapple, a former computer scientist at the National Security Agency, said in an interview. “You can think of SolarWinds as having the master keys to your network, and if you’re able to compromise that type of tool, you’re able to use those types of keys to gain access to other parts of the network. By compromising that, you have a key basically to unlock the network infrastructure of a large number of organizations.”

The hacks are part of what the federal government and officials from FireEye, Microsoft, and other private companies said was a widespread espionage campaign that a sophisticated threat actor was carrying out through a supply chain attack.

In blog post FireEye published Sunday night, the company said it uncovered a global intrusion campaign that used the backdoored SolarWinds’ update mechanism as an initial entryway “into the networks of public and private organizations through the software supply chain.” Publications—including The Washington Post and The New York Times—cited unnamed government officials saying Cozy Bear, a hacking group believed to be part of the Russian Federal Security Service (FSB) was behind the compromises.

“Based on our analysis, we have now identified multiple organizations where we see indications of compromise dating back to the Spring of 2020, and we are in the process of notifying those organizations,” FireEye officials wrote. “Our analysis indicates that these compromises are not self-propagating; each of the attacks require meticulous planning and manual interaction. Our ongoing investigation uncovered this campaign, and we are sharing this information consistent with our standard practice.”

In a separate post also published Sunday night, FireEye added: “FireEye has uncovered a widespread campaign, that we are tracking as UNC2452. The actors behind this campaign gained access to numerous public and private organizations around the world. They gained access to victims via trojanized updates to SolarWind’s Orion IT monitoring and management software. This campaign may have begun as early as Spring 2020 and is currently ongoing. Post compromise activity following this supply chain compromise has included lateral movement and data theft. The campaign is the work of a highly skilled actor and the operation was conducted with significant operational security.”

FireEye went on to say that a digitally signed component of the Orion framework contained a backdoor that communicates with hacker-controlled servers. The backdoor, planted in the Windows dynamic link library file SolarWinds.Orion.Core.BusinessLayer.dll, was written to remain stealthy, both by remaining dormant for a couple weeks and then blending in with legitimate SolarWinds data traffic. FireEye researchers wrote:

The trojanized update file is a standard Windows Installer Patch file that includes compressed resources associated with the update, including the trojanized SolarWinds.Orion.Core.BusinessLayer.dll component. Once the update is installed, the malicious DLL will be loaded by the legitimate SolarWinds.BusinessLayerHost.exe or SolarWinds.BusinessLayerHostx64.exe (depending on system configuration). After a dormant period of up to two weeks, the malware will attempt to resolve a subdomain of avsvmcloud[.]com. The DNS response will return a CNAME record that points to a Command and Control (C2) domain. The C2 traffic to the malicious domains is designed to mimic normal SolarWinds API communications. The list of known malicious infrastructure is available on FireEye’s GitHub page.

Burrowing in further

The Orion backdoor, which FireEye is calling Sunburst and Microsoft calls Solorigate, gave the hackers the limited but crucial access to internal network devices. The hackers then used other techniques to burrow further. According to Microsoft, the hackers then stole signing certificates that allowed them to impersonate any of a target’s existing users and accounts through the Security Assertion Markup Language. Typically abbreviated as SAML, the XML-based language provides a way for identity providers to exchange authentication and authorization data with service providers.

Microsoft’s advisory stated:

• An intrusion through malicious code in the SolarWinds Orion product. This results in the attacker gaining a foothold in the network, which the attacker can use to gain elevated credentials. Microsoft Defender now has detections for these files. Also, see SolarWinds Security Advisory.
• An intruder using administrative permissions acquired through an on-premises compromise to gain access to an organization’s trusted SAML token-signing certificate. This enables them to forge SAML tokens that impersonate any of the organization’s existing users and accounts, including highly privileged accounts.
• Anomalous logins using the SAML tokens created by a compromised token-signing certificate, which can be used against any on-premises resources (regardless of identity system or vendor) as well as against any cloud environment (regardless of vendor) because they have been configured to trust the certificate. Because the SAML tokens are signed with their own trusted certificate, the anomalies might be missed by the organization.
• Using highly privileged accounts acquired through the technique above or other means, attackers may add their own credentials to existing application service principals, enabling them to call APIs with the permission assigned to that application.

Supply chain attacks are among the hardest to counter because they rely on software that’s already trusted and widely distributed. SolarWinds’ Monday-morning filing suggests that Cozy Bear hackers had the ability to infect the networks about 18,000 of the company’s customers. It’s not yet clear how many of those eligible users were actually hacked.

The Department of Homeland Security’s Cybersecurity Infrastructure and Infrastructure Security Agency has issued an emergency directive instructing federal agencies that use SolarWinds products to analyze their networks for signs of compromise. FireEye’s post here lists a variety of signatures and other indicators admins can use to detect infections.

https://arstechnica.com/?p=1729731

Pornhub last night purged millions of user-uploaded videos from its platform amid allegations that it was hosting content featuring child sexual exploitation, nonconsensual violence, rape, and other unlawful material.

“As part of our policy to ban unverified uploaders, we have now also suspended all previously uploaded content that was not created by content partners or members of the Model Program,” Pornhub said in a company blog post, as first reported by Vice. The purge appears to have hit almost 9 million of the 13.5 million videos on Pornhub as of Sunday, or nearly two-thirds of all the content hosted on the site.

“This means every piece of Pornhub content is from verified uploaders, a requirement that platforms like Facebook, Instagram, TikTok, YouTube, Snapchat and Twitter have yet to institute,” the company added. “In today’s world, all social media platforms share the responsibility to combat illegal material. Solutions must be driven by real facts and real experts. We hope we have demonstrated our dedication to leading by example.”

The swipe at other social media platforms is no accident. “It is clear that Pornhub is being targeted not because of our policies and how we compare to our peers, but because we are an adult content platform,” the company added. Citing Facebook’s transparency report, the company added, “Over the last three years, Facebook self-reported 84 million instances of child sexual abuse material. During that same period, the independent, third-party Internet Watch Foundation reported 118 incidents on Pornhub. That is still 118 too many, which is why we are committed to taking every necessary action.”

So fast, too slow

The rapid changes at Pornhub follow a December 4 report from New York Times columnist Nicholas Kristof, who alleged that “many” of the 6.8 million videos uploaded to Pornhub each year depict rape, child sexual exploitation, or other unlawful activity. At the time of the report, Pornhub allowed any user to upload content—and to download content, adding a new layer of difficulty to moderation, as anything that was taken down could simply be re-uploaded again. Kristof interviewed multiple young women who had videos of them uploaded to the site without their knowledge or consent when they were children or teenagers, and who claimed the videos kept resurfacing even after they requested them taken down.

The report was published on a Friday, and before the end of that weekend, both Visa and MasterCard were conducting their own investigations of Pornhub and its parent company, Mindgeek. By Wednesday, Pornhub had halted uploads and downloads from users outside of its “content partners” and verified “model” program, which theoretically would drastically reduce the potential for unlawful, abusive, or exploitative videos to be uploaded to the site. Today’s purge of unverified content is an extension of that policy change, Pornhub explained.

The policy change, however, apparently came too late for Visa and MasterCard, as both payment processors banned Pornhub from accepting either platform as payment. The ripple effects go beyond just hurting the site or Mindgeek. Now, verified performers and sex workers who rely on Pornhub hosting to make a completely legal living currently cannot get paid for their work through Visa, MasterCard, American Express, or PayPal.

https://arstechnica.com/?p=1729675

A coded message sent by a brutal serial killer who has never been caught has been cracked more than 51 years after it was sent.

The male suspect, known as the Zodiac Killer, killed at least five people and attempted to kill at least two more in Northern California in 1968 and 1969. In the first three attacks, he targeted couples. The first two murder victims were high school students who were parked in a car on their first date. In attacks on the other two couples, he managed to kill the women, but the men survived. A male San Francisco cab driver was the last known victim.

During the murder spree, the Zodiac Killer sent media outlets a series of letters taking credit for the slayings. To prove the authenticity of the claims, the letters included unreleased details and evidence from the crime scenes.

In August 1969, following the murders of three of the five known victims, the Zodiac Killer sent three almost identical letters to three Bay Area newspapers. Each letter also included one-third of a 408-symbol cryptogram that the suspect said would reveal his identity. The killer demanded the papers publish the letters in full or he would kill again.

A week after the letters were sent, a couple in Salinas, California, cracked the cipher. The Zodiac Killer, the plaintext revealed, said he was collecting slaves for the afterlife and that he wouldn’t disclose his identity because doing so would interfere with those plans.

In November 1969, after killing the remaining two known victims, the Zodiac Killer sent a letter to the San Francisco Chronicle that included a new puzzle. The cryptogram was known as the Z-340, or simply the 340, because it contained 340 characters in it. The full image of the cryptogram appears below:

Ever since then, both amateur and professional cryptographers, including those working for the FBI, have worked to crack the cipher. It wasn’t until this week that an international team solved it.

“The cipher had been unsolved for so long, it had a huge target on its back, and I felt like it was a challenge that had a chance of being solved,” Dave Oranchak, one of the three men who cracked the encoded message, said by email. “It was an exciting project to work on, and it was on many people’s ‘top unsolved ciphers of all time’ lists.”

The full text of the cracked cipher reads:

I HOPE YOU ARE HAVING LOTS OF FUN IN TRYING TO CATCH ME THAT WASN’T ME ON THE TV SHOW WHICH BRINGS UP A POINT ABOUT ME I AM NOT AFRAID OF THE GAS CHAMBER BECAUSE IT WILL SEND ME TO PARADICE ALL THE SOONER BECAUSE I NOW HAVE ENOUGH SLAVES TO WORK FOR ME WHERE EVERYONE ELSE HAS NOTHING WHEN THEY REACH PARADICE SO THEY ARE AFRAID OF DEATH I AM NOT AFRAID BECAUSE I KNOW THAT MY NEW LIFE WILL BE AN EASY ONE IN PARADICE DEATH

The decoded message squares with much of what is already known about the case. The mention of the TV show and gas chambers refers to a call made to a talk show on KGO-TV a month earlier, in which someone claiming to be the Zodiac Killer said: “I need help. I’m sick. I don’t want to go to the gas chamber.” In other communications, the killer used the same misspelling for the word “paradise.” And of course, there were earlier references to collecting slaves for the afterlife.

The FBI in San Francisco has since confirmed that the team has correctly solved the cryptogram. In a statement issued on Friday, the agency wrote:

The FBI is aware that a cipher attributed to the Zodiac Killer was recently solved by private citizens. The Zodiac Killer case remains an ongoing investigation for the FBI San Francisco division and our local law enforcement partners. The Zodiac Killer terrorized multiple communities across Northern California and even though decades have gone by, we continue to seek justice for the victims of these brutal crimes. Due to the ongoing nature of the investigation, and out of respect for the victims and their families, we will not be providing further comment at this time.

Oranchak, a 46-year-old software developer in Virginia, said the 340 is what’s known as a transposition cipher. Most ciphers used today by computers rely on mathematics to scramble messages. Transposition ciphers, by contrast, are largely relics from the past that use rules to rearrange the characters or groups of characters in the message.

Transposition ciphers rearrange messages in a wide variety of ways. A common way is by rearranging columns of a message. The message in the 340 was probably rearranged by manipulating triangular sections cut from messages written into rectangles. Oranchak and his colleagues developed an app that helped him and his colleagues unravel the puzzle.

In the video below, Oranchak provides a much more detailed explanation of the cipher and how he and his colleagues cracked it.

Oranchak said he has been working on and off on solving the 340 since 2006. The other two men on the team are Sam Blake, an applied mathematician who lives in Australia, and Jarl Van Eycke, a warehouse operator in Belgium. Van Eycke is also the software developer behind the AZdecrypt, a code-breaking app that was inspired by his drive to crack the 340.

https://arstechnica.com/?p=1729495

Oracle is moving its global headquarters from Silicon Valley to Austin, Texas, the company announced in a filing with the Securities and Exchange Commission.

“Oracle is implementing a more flexible employee work location policy and has changed its Corporate Headquarters from Redwood City, California, to Austin, Texas,” Oracle wrote in its quarterly SEC filing. “We believe these moves best position Oracle for growth and provide our personnel with more flexibility about where and how they work.”

The company will continue to maintain an office at its previous headquarters in Redwood City, California, and other offices around the country. Oracle has 135,000 employees.

Bloomberg reports that Oracle opened an Austin campus in 2018, hoping to take advantage of the region’s lower cost of living. The campus was designed to host 10,000 employees.

The skyrocketing cost of real estate in the San Francisco Bay Area—and perhaps California’s high taxes—have encouraged a growing number of Silicon Valley companies to move operations outside of California. The pandemic has also forced companies to rely more on remote work, making it easier for companies to decentralize their workforces.

HP Enterprise, an enterprise software company that was spun off from the original HP in 2015, moved its headquarters to the Houston area last week. This week, Elon Musk revealed he had personally moved to Texas to be closer to SpaceX’s Boca Chica launch facility (where Starship is being tested) and Tesla’s new car factory in the Austin area.

Apple announced a major expansion of its Austin campus two years ago. Its headquarters continues to be in Silicon Valley.

Palantir also recently announced that it was leaving Silicon Valley, but it is moving to Colorado.

Oracle founder Larry Ellison is one of the most high-profile supporters of Donald Trump in the technology sector, so he may find that he fits in better in the more conservative state. It’s not clear if Ellison is personally moving to Texas. Ellison sits on Tesla’s board.

https://arstechnica.com/?p=1729504

There aren’t enough game consoles in the world for our upcoming locked-down holiday. Good luck finding a PS5 for Christmas. As Nintendo similarly struggles to keep up with demand, the number of people searching iFixit for Switch repair guides has more than tripled since last year. Traffic to our Joy-Con controller repair page started growing dramatically on March 14—the day after President Trump declared a national emergency. It’s been surging ever since. At a time when so many of us are turning to games for fun, stress relief, and social connection, it is imperative for our collective sanity that we press every game console into service.

But if you talk with expert repair technicians like Bryan Harwell, they’ll tell you that significant obstacles stand in the way.

At Replay’d, Harwell’s Boston repair and game shop, one out of every 10 customers brings in a console with a broken optical drive. Not only does a broken drive mean you can’t play your favorite discs, but on most Xbox and PlayStation models, a faulty DVD or Blu-ray drive will cause the whole console to stop working, even if the owner mostly plays downloaded, digital games. Harwell has hundreds of Xboxes in the shop basement that his technicians could harvest drives from, but there’s a catch—an obscure part of US copyright law makes it illegal for him to repurpose those drives. All too often, he’s had to give a hopeful child a dour prognosis: The only cost-effective way to fix their console is illegal. The only legal path requires parts so expensive that they’d be better off buying a new console (if they can find one).

The root of the problem is that Microsoft and Sony lock down the software they use to pair their disc readers with their consoles’ motherboards. Shops like Replay’d could easily replace those drives by accessing the software pairing the drives with the boards. Instead, the repair industry is cowering in fear of a relatively obscure provision of copyright law banning the removal of digital locks that’s kept everyone from gamers to farmers and hospitals from fixing the devices they own.

Fortunately, Congress built an escape hatch. Every three years, the Librarian of Congress decides that, for certain products, circumvention of these digital locks should be allowed. That time is once again upon us. Next week, with the help of Public Knowledge and our fellow advocates for Right to Repair, iFixit will ask the US Copyright Office to make fixing consoles, along with other software-enabled devices, legal.

Section 1201 of the Digital Millennium Copyright Act, passed by Congress in 1998, makes it illegal to “circumvent a technological measure that effectively controls access to a copyrighted work.” In Harwell’s case, the copyrighted work is the firmware on the optical drive.

Manufacturers, and the Copyright Office, have interpreted this to mean that maneuvering around the digital locks on your own devices in order to fix them is against the law. And the penalties for breaking this law are harsh, with fines up to $150,000 and even jail time.

The result is that too many beloved consoles are heading for the trash heap rather than getting regifted under the Christmas tree. That’s a shame, because the demand is there—iFixit’s Xbox and PlayStation repair pages get hundreds of thousands of hits every year.

Manufacturers argue that enabling repair will open a Pandora’s box of game piracy and cheating. But pirates and cheaters aren’t deterred by copyright law. The Entertainment Software Association claims that the locks are necessary to “to prevent users from making unauthorized copies.” They point out that manufacturers have mail-in repair programs and will happily fix your console for a fee. But when I logged in to Microsoft.com to see what it would cost to fix the drive in my Xbox One, they told me “there are no service options available.”

If the manufacturers won’t fix them, then consumers and repair shops will have to maintain their consoles themselves. But all the latest consoles have locks getting in the way of standard repairs, and gamers are stuck without options. After modders discovered a way around the Xbox 360’s safeguards with a drill and a resistor, Microsoft built a custom circuit board onto the Xbox One optical drive. That game-verifying board shares a secret key with the main processor, and removing either one causes the system to fail.

Earlier this month, we took apart the Xbox Series X and the PlayStation 5. Both offer optical drives that let you enjoy your library of older game discs, but after trying to swap the drives between two of our brand-new PS5s (this is only slightly a humblebrag that we have two glorious new consoles), the console complained that our newly unwrapped copy of Spider-Man: Miles Morales “isn’t supported by the PS5.” We quickly swapped them back. Sadly, the new Xbox also pairs its optical drive and motherboard.

That leaves gamers stuck with a catch-22: The manufacturers won’t fix their consoles, and it’s illegal for them to do it themselves. That’s why we go back to Congress every three years seeking exemptions. And it’s worked: We’ve successfully legalized unlocking cell phones, modifying smart home devices and vehicles, and fixing tractors. But three years ago, they denied my request for video game repair—leaving console gamers in the lurch.

Game consoles aren’t the only things that are illegal to fix. Philips is suing companies who repair medical equipment for hospitals, arguing that they have circumvented digital locks in the course of their work. Sound familiar? That’s because there’s not much practical difference between the software in your console, your smartphone, or a ventilator. They’re all just computers. But the Copyright Office insists on defining these categories so narrowly that we have to apply for separate exemptions for each type of product. For instance, the Copyright Office requires us to apply for a different exemption for smart televisions than smart refrigerators, even though Samsung uses the same Tizen operating system for both. Accessing the software in the exact same John Deere engine in a tractor or a boat requires two totally different exemptions. According to the Copyright Office, the former is currently allowed and the latter is not.

Hopefully some boat mechanics will band together to hire expensive IP lawyers that can ask Washington to make their trade legal again. If that sounds ludicrous, that’s exactly what Summit Imaging and Transtate Equipment, two medical servicing companies, are doing right now.

This hodgepodge of product-specific exemptions is the result of a process that is biased against tech users. Having to go to the Copyright Office every three years, hat in hand, to ask for permission to simply fix our stuff is infuriating. Congress thinks so too, and Representative Zoe Lofgren of California has repeatedly introduced legislation that would grant a permanent exemption to Section 1201 for activities like repair that don’t otherwise violate copyright law.

A lot has happened in the last three years, and a lot will happen in the next three. Tech moves at a speed that far outpaces the Copyright Office’s exemption process. There’s no way current copyright exemptions can predict (and protect us from) new repair-hostile practices, emerging tech, or a global supply-chain breakdown. The Copyright Office may believe it’s protecting the content industry’s interests, but in reality, it’s hamstringing essential repair services—critical to keeping the things that power our economy running—with arbitrary rules and burdensome administrative processes. We can’t keep playing exemption whack-a-mole. Consumers deserve the right to repair everything that they own.

Unfortunately for now, we’re stuck with a broken law. But an exemption for gaming consoles will help people and repair shops get consoles working again, save more circuit boards from clogging waste streams, and get you back to playing your favorite games.

Even though manufacturers keep releasing new consoles, repair shops are seeing real demand to keep older game consoles running. Harwell knows there are some customers who—out of nostalgia, frugality, or a desire to appease the kids—want to fire up an earlier Xbox or PlayStation and jam with some old favorites.

But the inability to fix consoles without a new motherboard or time-consuming soldering work make repairs more expensive than they need to be. Tim Mentzer, owner of Mentzer Repairs in Ephrata, Pennsylvania, estimates that locked-down parts are responsible for about 70 percent of decommissioned consoles at his shop—either because of physical impossibility or because the required parts make it too expensive for his customers.

When I spoke to Harwell at Replay’d, he didn’t mince words, “Microsoft and Sony are being irresponsible,” he told me. “It’s irresponsible that they make consoles with a part that could be easily replaced so difficult to [repair]. You could prevent all the waste once the drives go bad. We end up with all these boxes just recycled and trashed.”

This story originally appeared on wired.com.

https://arstechnica.com/?p=1729471

YouTube, Facebook, and other social media platforms were instrumental in radicalizing the terrorist who killed 51 worshippers in a March 2019 attack on two New Zealand mosques, according to a new report from the country’s government. Online radicalization experts speaking with WIRED say that while platforms have cracked down on extremist content since then, the fundamental business models behind top social media sites still play a role in online radicalization.

According to the report, released this week, the terrorist regularly watched extremist content online and donated to organizations like the Daily Stormer, a white supremacist site, and Stefan Molyneux’s far-right Freedomain Radio. He also gave directly to Austrian far-right activist Martin Sellner. “The individual claimed that he was not a frequent commenter on extreme right-wing sites and that YouTube was, for him, a far more significant source of information and inspiration,” the report says.

The terrorist’s interest in far-right YouTubers and edgy forums like 8chan is not a revelation. But until now, the details of his involvement with these online far-right organizations were not public. Over a year later, YouTube and other platforms have taken steps toward accepting responsibility for white supremacist content that propagates on their websites, including removing popular content creators and hiring thousands more moderators. Yet according to experts, until social media companies open the lid on their black-box policies and even algorithms, white supremacist propaganda will always be a few clicks away.

“The problem goes far deeper than the identification and removal of pieces of problematic content,” said a New Zealand government spokesperson over email. “The same algorithms that keep people tuned to the platform and consuming advertising can also promote harmful content once individuals have shown an interest.”

Entirely unexceptional

The Christchurch attacker’s pathway to radicalization was entirely unexceptional, say three experts speaking with WIRED who had reviewed the government report. He came from a broken home and from a young age was exposed to domestic violence, sickness, and suicide. He had unsupervised access to a computer, where he played online games and, at age 14, discovered the online forum 4chan. The report details how he expressed racist ideas at his school, and he was twice called in to speak with its anti-racism contact officer regarding anti-Semitism. The report describes him as somebody with “limited personal engagement,” which “left considerable scope for influence from extreme right-wing material, which he found on the internet and in books.” Aside from a couple of years working as a personal trainer, he had no consistent employment.

The terrorist’s mother told the Australian Federal Police that her concerns grew in early 2017. “She remembered him talking about how the Western world was coming to an end because Muslim migrants were coming back into Europe and would out-breed Europeans,” the report says. The terrorist’s friends and family provided narratives of his radicalization that are supported by his internet activity: shared links, donations, comments. While he was not a frequent poster on right-wing sites, he spent ample time in the extremist corners of YouTube.

A damning 2018 report by Stanford researcher and PhD candidate Becca Lewis describes the alternative media system on YouTube that fed young viewers far-right propaganda. This network of channels, which range from mainstream conservatives and libertarians to overt white nationalists, collaborated with each other, funneling viewers into increasingly extreme content streams. She points to Stefan Molyneux as an example. “He’s been shown time and time again to be an important vector point for people’s radicalization,” she says. “He claimed there were scientific differences between the races and promoted debunked pseudoscience. But because he wasn’t a self-identified or overt neo-Nazi, he became embraced by more mainstream people with more mainstream platforms.” YouTube removed Molyneux’s channel in June of this year.

This “step-ladder of amplification” is in part a byproduct of the business model for YouTube creators, says Lewis. Revenue is directly tied to viewership, and exposure is currency. While these networks of creators played off each other’s fan bases, the drive to gain more viewers also incentivized them to post increasingly inflammatory and incendiary content. “One of the most disturbing things I found was not only evidence that audiences were getting radicalized, but also data that literally showed creators getting more radical in their content over time,” she says.

Making “significant progress”?

In an email statement, a YouTube spokesperson says that the company has made “significant progress in our work to combat hate speech on YouTube since the tragic attack at Christchurch.” Citing 2019’s strengthened hate speech policy, the spokesperson says that there has been a “5x spike in the number of hate videos removed from YouTube.” YouTube has also altered its recommendation system to “limit the spread of borderline content.”

YouTube says that of the 1.8 million channels terminated for violating its policies last quarter, 54,000 were for hate speech—the most ever. YouTube also removed more than 9,000 channels and 200,000 videos for violating rules against promoting violent extremism. In addition to Molyneux, YouTube’s June bans included David Duke and Richard Spencer. (The Christchurch terrorist donated to the National Policy Institute, which Spencer runs.) For its part, Facebook says it has banned over 250 white supremacist groups from its platforms, and strengthened its dangerous individuals and groups policy.

“It’s clear that the core of the business model has an impact on allowing this content to grow and thrive,” says Lewis. “They’ve tweaked their algorithm, they’ve kicked some people off the platform, but they haven’t addressed that underlying issue.”

Online culture does not begin and end with YouTube or anywhere else, by design. Fundamental to the social media business model is cross-platform sharing. “YouTube isn’t just a place where people go for entertainment; they get sucked into these communities. Those allow you to participate via comment, sure, but also by making donations and boosting the content in other places,” says Joan Donovan, research director of Harvard University’s Shorenstein Center on Media, Politics, and Public Policy. According to the New Zealand government’s report, the Christchurch terrorist regularly shared far-right Reddit posts, Wikipedia pages, and YouTube videos, including in an unnamed gaming site chat.

Fitting in

The Christchurch mosque terrorist also followed and posted on several white nationalist Facebook groups, sometimes making threatening comments about immigrants and minorities. According to the report authors who interviewed him, “the individual did not accept that his comments would have been of concern to counter-terrorism agencies. He thought this because of the very large number of similar comments that can be found on the internet.” (At the same time, he did take steps to minimize his digital footprint, including deleting emails and removing his computer’s hard drive.)

Reposting or proselytizing white supremacist without context or warning, says Donovan, paves a frictionless road for the spread of fringe ideas. “We have to look at how these platforms provide the capacity for broadcast and for scale that, unfortunately, have now started to serve negative ends,” she says.

YouTube’s business incentives inevitably stymie that sort of transparency. There aren’t great ways for outside experts to assess or compare techniques for minimizing the spread of extremism cross-platform. They often must rely instead on reports put out by the businesses about their own platforms. Daniel Kelley, associate director of the Anti-Defamation League’s Center for Technology and Society, says that while YouTube reports an increase in extremist content takedowns, the measure doesn’t speak to its past or current prevalence. Researchers outside the company don’t know how the recommendation algorithm worked before, how it changed, how it works now, and what the effect is. And they don’t know how “borderline content” is defined—an important point considering that many argue it continues to be prevalent across YouTube, Facebook, and elsewhere.

Questionable results

“It’s hard to say whether their effort has paid off,” says Kelley. “We don’t have any information on whether it’s really working or not.” The ADL has consulted with YouTube, however Kelley says he hasn’t seen any documents on how it defines extremism or trains content moderators on it.

A real reckoning over the spread of extremist content has incentivized big tech to put big money on finding solutions. Throwing moderation at the problem appears effective. How many banned YouTubers have withered away in obscurity? But moderation doesn’t address the ways in which the foundations of social media as a business—creating influencers, cross-platform sharing, and black-box policies—are also integral factors in perpetuating hate online.

Many of the YouTube links the Christchurch shooter shared have been removed for breaching YouTube’s moderation policies. The networks of people and ideologies engineered through them and through other social media persist.

This story originally appeared on wired.com.

https://arstechnica.com/?p=1729416