Senate Majority Leader Mitch McConnell (R-Ky.) has moved to end debate over a Trump nomination that would deadlock the Federal Communications Commission, setting up a vote that could happen as soon as next week.

McConnell yesterday filed a cloture motion on Trump’s nomination of Republican Nathan Simington to the FCC. McConnell’s motion came one day after the Senate Commerce Committee voted 14-12 along party lines to advance the nomination to the full Senate.

“If Simington is confirmed, the FCC could initially be deadlocked 2-2 between Democrats and Republicans when Democratic President-elect Joe Biden takes office next month. Some officials think the Senate might not confirm [a Biden] appointee to the commission for months, if not longer,” Reuters wrote yesterday.

We asked McConnell’s office when the Simington vote will occur and will update this article if we get a response.

Simington backs Trump attack on social media sites

Simington, a Trump administration official who helped draft a petition asking the FCC to make it easier to sue social media companies like Facebook and Twitter, would replace Republican Michael O’Rielly. O’Rielly’s renomination was pulled by Trump after he did not support Trump’s attempted crackdown on Twitter and Facebook. O’Rielly said the First Amendment protects the editorial decisions made by Web platforms that host user-generated content.

With Chairman Ajit Pai planning to leave the FCC upon Biden’s inauguration, the Senate’s decision on Simington would make the difference between a 2-1 Democratic majority and a 2-2 deadlock. Biden should eventually be able to secure a 3-2 majority on the FCC, but it could be difficult if Republicans maintain Senate control after the runoff elections in Georgia. Republicans currently have a 52-48 Senate majority and will hold between 50 and 52 seats after the runoffs, depending on the results.

FCC Republican pushes for deadlock

A Democratic-majority FCC could reinstate net neutrality rules along with Title II regulation of broadband, a possibility that Republicans are trying to prevent or at least delay. FCC Republican Brendan Carr this week appeared on Fox Business and said, “It would be very valuable to get Simington across the finish line to help forestall what really would be billions of dollars worth of economic damage that I think a Democrat FCC would look to jam through from day one in January or February.” (Despite Carr’s claims, the Obama-era Title II regulation and net neutrality rules did not slow down investments in broadband networks, but major ISPs have cut back on network spending since the Pai-led FCC deregulated the industry and repealed the rules.)

Sens. Richard Blumenthal (D-Conn.) and Maria Cantwell (D-Wash.) spoke out against Simington’s nomination at the Commerce Committee hearing Wednesday, saying that Simington isn’t qualified for the position and that he misrepresented his role in pushing Trump’s attack on social media companies. Blumenthal pledged to fight the nomination in the full Senate, saying, “I will continue to do everything I can to hold this nomination and to oppose it because I think Mr. Simington lacks the qualifications and independence that are required of an FCC commissioner.”

We asked Blumenthal’s and Cantwell’s offices about plans to fight the nomination on the Senate floor and will update this article if we get any response. Given the Republicans’ Senate majority, there probably isn’t much they can do unless some Republicans buck the party line.

https://arstechnica.com/?p=1727670

Google struggled on Thursday to limit the fallout from the departure of a top artificial intelligence researcher after the Internet group blocked the publication of a paper on an important AI ethics issue.

Timnit Gebru, who had been co-head of AI ethics at Google, said on Twitter that she had been fired after the paper was rejected.

Jeff Dean, Google’s head of AI, defended the decision in an internal email to staff on Thursday, saying the paper “didn’t meet our bar for publication.” He also described Dr. Gebru’s departure as a resignation in response to Google’s refusal to concede to unspecified conditions she had set to stay at the company.

The dispute has threatened to shine a harsh light on Google’s handling of internal AI research that could hurt its business, as well as the company’s long-running difficulties in trying to diversify its workforce.

Before she left, Gebru complained in an email to fellow workers that there was “zero accountability” inside Google around the company’s claims it wants to increase the proportion of women in its ranks. The email, first published on Platformer, also described the decision to block her paper as part of a process of “silencing marginalised voices.”

One person who worked closely with Gebru said that there had been tensions with Google management in the past over her activism in pushing for greater diversity. But the immediate cause of her departure was the company’s decision not to allow the publication of a research paper she had coauthored, this person added.

The paper looked at the potential bias in large-scale language models, one of the hottest new fields of natural language research. Systems like OpenAI’s GPT-3 and Google’s own system, Bert, attempt to predict the next word in any phrase or sentence—a method that has been used to produce surprisingly effective automated writing and which Google uses to better understand complex search queries.

The language models are trained on vast amounts of text, usually drawn from the Internet, which has raised warnings that they could regurgitate racial and other biases that are contained in the underlying training material.

“From the outside, it looks like someone at Google decided this was harmful to their interests,” said Emily Bender, a professor of computational linguistics at the University of Washington, who co-authored the paper.

“Academic freedom is very important—there are risks when [research] is taking place in places that [don’t] have that academic freedom,” giving companies or governments the power to “shut down” research they don’t approve of, she added.

Bender said the authors hoped to update the paper with newer research in time for it to be accepted at the conference to which it had already been submitted. But she added that it was common for such work to be superseded by newer research, given how quickly work in fields like this is progressing. “In the research literature, no paper is perfect.”

Julien Cornebise, a former AI researcher at DeepMind, the London-based AI group owned by Google’s parent, Alphabet, said that the dispute “shows the risks of having AI and machine learning research concentrated in the few hands of powerful industry actors, since it allows censorship of the field by deciding what gets published or not.”

He added that Gebru was “extremely talented—we need researchers of her calibre, no filters, on these issues.” Gebru did not immediately respond to requests for comment.

Dean said that the paper, written with three other Google researchers, as well as external collaborators, “didn’t take into account recent research to mitigate” the risk of bias. He added that the paper “talked about the environmental impact of large models, but disregarded subsequent research showing much greater efficiencies.”

© 2020 The Financial Times Ltd. All rights reserved Not to be redistributed, copied, or modified in any way.

https://arstechnica.com/?p=1727632

The Department of Homeland Security (DHS) inspector general is investigating the government’s use of cell phone location data obtained without search warrants.

US Customs and Border Protection (CBP), a division of DHS, “has paid a government contractor named Venntel nearly half a million dollars for access to a commercial database containing location data mined from applications on millions of Americans’ mobile phones,” five Democratic US senators said in October.

“CBP is not above the law and it should not be able to buy its way around the Fourth Amendment,” the senators told Inspector General Joseph Cuffari while requesting an investigation into “CBP’s warrantless use of commercial databases containing Americans’ information, including but not limited to Venntel’s location database.”

Cuffari granted the request for an investigation, telling the senators that his office will “initiate an audit that we believe will address your concerns” in a letter sent November 25 and made public by the Democratic senators yesterday. The senators who requested the investigation are Ron Wyden (D-Ore.), Elizabeth Warren (D-Mass.), Sherrod Brown (D-Ohio), Edward Markey (D-Mass.), and Brian Schatz (D-Hawaii).

“The objective of our audit is to determine if the Department of Homeland Security (DHS) and it[s] components have developed, updated, and adhered to policies related to cell-phone surveillance devices,” Cuffari wrote. The audit will also examine DHS’ use of “open source intelligence,” which includes “information provided by the public via cellular devices, such as social media status updates, geo-tagged photos, and specific location check-ins,” Cuffari told the senators.

Separately, the American Civil Liberties Union (ACLU) sued the DHS, CBP, and ICE (Immigration and Customs Enforcement) yesterday, demanding the release of “records about their purchases of cell phone location data for immigration enforcement and other purposes.” You can find more detail on Venntel’s sales of location data to US agencies in a Vice article published today, titled “How an ICE Contractor Tracks Phones Around the World.”

DHS claims data purchases are legal

The major cell phone carriers used to sell customers’ real-time location data to third-party data brokers without customer consent, leading to fines proposed by the Federal Communications Commission. The carriers say they have stopped the practice, but third-party brokers still sell location data obtained from applications installed on phones.

“The data DHS is using doesn’t come from the mobile carriers, however, but from marketing companies that collect it through software applications,” The Wall Street Journal wrote yesterday.

A 2018 Supreme Court ruling said that “the Government must generally obtain a warrant supported by probable cause before acquiring” cell-site location information created and maintained by wireless carriers. But because DHS is buying location data from third-party sellers instead of carriers, DHS lawyers claim that the ruling doesn’t apply, “a legal theory untested in any court,” the Journal wrote.

“Such data is widely used by the US military and intelligence agencies for intelligence gathering overseas, according to public records and people familiar with the matter, but those agencies are largely barred from domestic monitoring,” the Journal wrote. “However, law-enforcement agencies have concluded that they don’t need a warrant to obtain location data on phones within the US because consumers technically can opt out of such location tracking and the data is available for purchase on the open market.” The Treasury Department’s inspector general is already “probing the Internal Revenue Service’s use of the same data for criminal enforcement,” and “several congressional investigations are underway,” the Journal wrote.

Democratic senators say that the DHS investigation must be a thorough one. “If federal agencies are tracking American citizens without warrants, the public deserves answers and accountability,” Wyden said. “I won’t accept anything less than a thorough and swift inspector general investigation that sheds light on CBP’s phone location data surveillance program.”

“I’m glad that the Inspector General agreed to our request to investigate this potentially unconstitutional abuse of power by the CBP because we must protect the public’s Fourth amendment rights to be free from warrantless searches,” Warren said.

CBP also buys access to license plate-scanner information, allowing it to get the data without warrants.

https://arstechnica.com/?p=1727415

Google’s actions amid workplace organizing efforts, including the high-profile firings of several employees, were illegal violations of the National Labor Relations Act, federal regulators said this week.

The National Labor Relations Board filed a formal complaint (PDF) against Google Wednesday, alleging that the company has been “interfering with, restraining, and coercing employees” to interfere with their protected concerted activity—workplace organization rights that are protected by law.

Google fired several different workers late last year amid apparent efforts to organize company employees. Four former employees who were let go last November—Laurence Berland, Paul Duke, Rebecca Rivers, and Sophie Waldman—filed complaints with the NLRB almost exactly a year ago alleging that Google’s “draconian, pernicious, and unlawful conduct” was an unlawful attempt to prevent workplace organizing.

A few weeks later, another former Google employee, Kathryn Spiers, was fired after she developed a tool for the company’s internal build of Chrome that notified Google workers of their legal rights to organize. Spiers, too, filed a complaint with the NLRB claiming that Google’s retaliation against her was unlawful.

Google at the time alleged that Rivers, Berland, and others were fired for “intentional and often repeated violations of our longstanding data security policies.” According to the NLRB’s filing, however, Google put several of the rules the employees allegedly violated in place in response to the employee organizing efforts, and those rules were designed to “discourage employees from forming, joining, [or] assisting a union.” The company also unlawfully surveilled employees’ protected activities by viewing an employee slide deck in support of a union drive, as well as by interrogating employees about protected activities.

“Google’s hiring of IRI is an unambiguous declaration that management will no longer tolerate worker organizing,” Berland said in a statement, referring to Google bringing on the infamous union-busting firm as consultants in late 2019. “Management and their union busting cronies wanted to send that message, and the NLRB is now sending their own message: worker organizing is protected by law.”

Google issued a statement supporting its actions, again placing blame squarely on the former employees. “Google has always worked to support a culture of internal discussion, and we place immense trust in our employees,” a company spokesperson said. “Employees have protected labor rights that we strongly support, but we have always taken information security very seriously. We’re confident in our decision and legal position. Actions undertaken by the employees at issue were a serious violation of our policies and an unacceptable breach of a trusted responsibility.”

Not the first time

In terms of process, the NLRB’s complaint is somewhat similar to either a lawsuit in civil court or an indictment in criminal court. From here, Google and the regulator either settle the case or else it goes to an in-house trial before one of the NLRB’s administrative law judges. The complaint sets a hearing date for April 12 of next year, either in person or by video conference, if there is no settlement reached by that time.

Tensions between Google and its workers have been running high for several years. In 2018, thousands of employees staged a walkout to protest Google’s handling of sexual-harassment allegations against senior executives. Two employees who helped organize the 2018 mass walkout, Meredith Whittaker and Claire Stapleton, said in 2019 that they were facing retaliation from their employer. Both left the company that summer.

Neither is this Google’s first tangle with the NLRB. In 2019, the company and the regulator reached a settlement after a previous complaint. That settlement required Google to explain to employees the rights they have under federal labor law and to tell employees they would not be retaliated against for exercising those rights.

https://arstechnica.com/?p=1727307

Verizon is struggling to fix a glitch that has been leaking customers’ addresses, phone numbers, account numbers, and other personal information through a chat system that helps prospective subscribers figure out if Fios services are available in their location.

The personal details appear when people click on a link to chat with a Verizon representative. When the chat window opens, it contains transcripts of conversations that other customers, either prospective or current, have had. The transcripts include full names, addresses, phone numbers, account numbers (in the event they already have an account), and various other information. Some of the transcripts viewed by Ars date back to June. A separate Window included customers’ addresses, although it wasn’t clear who those addresses belonged to.

“Hi—I’m looking to get the teacher discount for Fios,” one person wrote on November 29. Below are redacted screenshots of some of what has been available.

Ars learned of the leak on Monday afternoon and alerted Verizon representatives immediately. The plan was to report the leak only after it had been fixed. As this post went live, the leak was still occurring, although the number of exposed chats had lessened. Ars decided to report the leak to alert people who may use the service that this data is being exposed. It’s not clear when Verizon began leaking the data. With some of the chats dating back to June, it’s possible that the leak has been occurring for months.

In a statement issued Thursday morning, Verizon said:

We’re looking into an issue involving our online chat system that assists individuals who are checking on the availability of Fios services. We believe a small number of users may have seen a name, phone number, and/or a home or building address from an unrelated individual who had previously used this chat system to enter that information. Since the issue was brought to our attention, we’ve identified and isolated the problem and are working to have it resolved as quickly as possible.

It’s not the first time Verizon has spilled customer information. In 2016, a database of more than 1.5 million Verizon Enterprise Solutions customers was put up for sale on an online crime forum. Verizon said at the time that a “security flaw in its site [had] permitted hackers to steal customer contact information,” according to KrebsOnSecurity, which broke the news.

Verizon was also one of four US cellphone carriers caught selling customers’ real-time locations to services that catered to law enforcement. One of the services made subscriber locations available to anyone who took the time to exploit an easily spotted bug in a free trial feature.

For the time being, it makes sense to avoid using Verizon’s Fios availability chat feature. This post will be updated once Verizon says the glitch has been fully fixed.

https://arstechnica.com/?p=1727360

Cyber attackers have targeted the cold supply chain needed to deliver COVID-19 vaccines, according to a report detailing a sophisticated operation likely backed by a nation-state.

The hackers appeared to be trying to disrupt or steal information about the vital processes to keep vaccines cold as they travel from factories to hospitals and doctors’ offices.

According to the report by IBM’s threat intelligence task force, which advises companies and the public sector on cyber security, they targeted organizations associated with a cold chain platform run by the Gavi vaccine alliance, a public-private partnership for developing immunization for poorer countries.

Many of the COVID-19 vaccines have to be kept cold to keep them from spoiling. Pfizer and BioNTech’s vaccine must be kept between minus 70C and minus 80C, while Moderna’s shot needs to be transported at minus 20C.

The attackers pretended to be an executive at a Chinese supplier of ultra-cold refrigeration to mount a phishing campaign trying to obtain usernames and passwords, the report said.

Nick Rossmann, IBM’s global lead for threat intelligence, said he believed the hackers were either looking to disrupt the vaccine delivery process or steal intellectual property.

“One side of it is cyber espionage: How do you get vaccines out? How is the manufacturing process working for refrigeration? How are you managing the entire logistics chain?” he said. “There’s also potential for disruption, being able to launch attacks that disrupt vaccines, and their distribution to undermine trust in them around the world.”

He added that it was vital to treat the vaccine supply chain as “a new type of global critical infrastructure” to help them secure the products that could help end the pandemic.

“These refrigeration companies are not going to have the same security tools that advanced financial institutions have,” he said.

The news prompted the US cyber agency on Wednesday to issue a formal alert to other groups involved in the cold supply chain.

Claire Zaboeva, senior strategic cyber threat analyst at IBM, said it could be the “tip of an iceberg” in a larger global campaign, as the hackers try to find holes in security and jump between companies and governments involved in the mass vaccination programs.

“It was an extremely well-researched and well-placed campaign. And that does potentially point to a very competent person or team,” she said.

The IBM report described a hacking campaign that spanned six countries, aimed at the European Commission’s customs and taxation unit, and organizations in energy, manufacturing and technology. The campaign started in September and the task force discovered the threat in October.

The IBM researchers do not know if the hackers were successful at gaining entry to the networks.

“Today’s report highlights the importance of cyber security diligence at each step in the vaccine supply chain,” said Josh Corman, the Cybersecurity and Infrastructure Security Agency’s chief strategist for healthcare.

The FBI has been notified of the attacks. The Gavi vaccine alliance said it had “strong policies and processes in place to prevent such phishing attacks and hacking attempts” and that it would continue to strengthen its security.

The European Commission said it was aware of the campaign and had taken “necessary steps” to mitigate the attack. It added that it takes cyber security seriously and investigates every incident.

Additional reporting by Kadhim Shubber in Washington DC.

© 2020 The Financial Times Ltd. All rights reserved Not to be redistributed, copied, or modified in any way.

https://arstechnica.com/?p=1727308

Senate Republicans are rushing to confirm President Donald Trump’s nominee to the Federal Communications Commission in order to create a 2-2 deadlock for the Biden FCC.

In a 14-12 party-line vote today, the Senate Commerce Committee approved Trump’s nomination of Nathan Simington. If Simington is confirmed by the full Senate, the FCC would be deadlocked at two Republicans and two Democrats after the upcoming departures of Chairman Ajit Pai and Michael O’Rielly. To get a 3-2 majority on the FCC, President-elect Joe Biden would have to nominate a Democrat after taking office and hope that the Senate confirms the nomination.

Senate Democrats said today that Simington is not qualified to be an FCC commissioner and that he misrepresented his work in the Trump administration during the committee’s confirmation process.

“I will continue this fight on the Senate floor,” Sen. Richard Blumenthal (D-Conn.) said. “I will continue to do everything I can to hold this nomination and to oppose it because I think Mr. Simington lacks the qualifications and independence that are required of an FCC commissioner.”

Approving Simington would create “a deadlock at the commission in the middle of a national crisis,” Blumenthal also said. “Perhaps the telecommunications and media companies want that kind of deadlock. They may wish for an FCC that is absent and neutralized. But we face right now a national emergency, both a pandemic and economic crisis that requires this independent agency to be more active than ever in protecting consumers and our telecommunications. The fact is, Mr. Simington has failed to provide this committee with an assurance that he will have the candor and independence that is required.”

Nominee backs Trump “assault on First Amendment”

No Republican senators offered any justification for confirming Simington at today’s meeting, which covered three nominations, including Simington’s, and lasted less than 15 minutes. Blumenthal and Sen. Maria Cantwell (D-Wash.) pointed out that Simington was nominated only after Trump pulled the renomination of O’Rielly, who did not support Trump’s attempted crackdown on Twitter and Facebook for alleged anti-conservative bias.

“It would seem that Mr. Simington was nominated for just one purpose: to support the president’s indefensible assault on the First Amendment,” Blumenthal said. “It appears in fact to be his sole qualification—his reason for replacing Commissioner O’Rielly.”

As Cantwell said, O’Rielly’s “nomination was reportedly pulled as retaliation for Mr. O’Rielly speaking his mind about problems with the FCC trying to issue rules related to section 230 at the president’s behest.” The process “raises real questions about why the White House chose Mr. Simington, particularly given his lack of experience with the FCC, its statutory responsibilities, and many of the key issues at the agency,” she said.

Simington is a senior adviser at the National Telecommunications and Information Administration (NTIA), which petitioned the FCC for a new interpretation of Section 230 of the Communications Decency Act to limit social media platforms’ legal protections for hosting third-party content when platforms take down or modify content they consider objectionable. Simington played a role in drafting and promoting that plan.

Blumenthal said he asked Simington to recuse himself from the FCC’s Section 230 proceeding, but Simington has not committed to do so.

Simington lobbied Fox News

Newly revealed emails showed that Simington “reached out to Fox News this summer in an attempt at ‘engaging’ host Laura Ingraham to support President Donald Trump’s quest to make it easier to sue social media companies like Facebook and Twitter,” Politico reported last week. “Simington… wrote that the popular Fox News host could help sway the FCC to act on Trump’s proposal before Election Day.”

Blumenthal and Cantwell said the emails proved that Simington downplayed his role in the Trump administration’s Section 230 proposal. Simington reportedly claimed during his nomination hearing that he had only a “minor role” in the NTIA’s petition to the FCC.

“We have learned he sought to enlist Fox News to ‘help get the FCC on board more quickly and thereby ensure a freer and fair social media landscape going into the elections this fall,'” Blumenthal said today, quoting from Simington’s email to a Fox News staffer. “He then described restraining social media companies as a concern both to the presidency and down ballot. He failed to disclose this to the committee, he failed to tell us about it, Mr. Chairman. So I asked Mr. Simington again and received a nonanswer.”

Nominee “misrepresented his involvement”

Blumenthal also said that Simington’s answers to questions from both Democratic and Republican senators were “inadequate, incomplete, and evasive.”

Cantwell said there are “real questions… about Mr. Simington’s candor with the committee during this confirmation process. We now know based on his own emails that he misrepresented his involvement in pushing the FCC to do the president’s bidding on Section 230.”

“The FCC and NTIA simply cannot be permitted to be an instrument of political bullying,” Blumenthal said. “It is an assault on the integrity and independence of the FCC, and this committee must take this threat seriously.”

FCC nominations have in some cases been approved in pairs, with one Democrat and one Republican joining the commission simultaneously. That’s what happened in August 2017 when Republican Brendan Carr and Democrat Jessica Rosenworcel were confirmed on the same day. Before that, Rosenworcel had to leave the commission for about seven months because the Republican-led Senate refused to reconfirm her, a move that gave Trump a 2-1 FCC majority when he took office.

“She had to leave the commission to ensure that President Trump could appoint an accompanying [Republican] FCC nominee, and we should hold this nomination as well,” Blumenthal said.

“Zero qualifications”

The sole purpose of Simington’s nomination is “obstructing the incoming Biden administration and its FCC appointees,” said Matt Wood, VP of policy and general counsel of media-advocacy group Free Press.

“Nathan Simington has zero qualifications for this position,” Wood said. “He’s here only as a result of strong-arm political tactics to reward his loyalty to Trump. Hand-picked and then forced on the Senate by a now-defeated president, Simington was not chosen for his expertise or ability, but for his apparent willingness to improperly cast a vote on the unlawful, unconstitutional, and just plain bad Section 230 petition that he helped write.”

Fight for the Future, an advocacy group, warned that Simington’s nomination is an attempt to prevent the restoration of net neutrality rules and urged people to contact their senators to oppose it.

https://arstechnica.com/?p=1727116

President Donald Trump has long been an outspoken foe of big technology companies. And in recent months, he has focused his ire on Section 230, a provision of the 1996 Communications Decency Act that shields online platforms from liability for content posted by their users.

In May, Trump called on the Federal Communications Commission to reinterpret the law—though it’s not clear the agency has the power to do that. Since then, he has tweeted about the issue incessantly.

On Tuesday evening, Trump ratcheted up his campaign against Section 230. In a tweet, he called the law “a serious threat to our National Security & Election Integrity.” He warned that “if the very dangerous & unfair Section 230 is not completely terminated as part of the National Defense Authorization Act (NDAA), I will be forced to unequivocally VETO the Bill.”

The NDAA is a massive spending bill that Congress passes each year to authorize funding for the military. This year’s version, now under active discussion on Capitol Hill, is expected to cost around $740 billion.

The NDAA is seen as a “must pass” bill because no one wants to be blamed for holding up funding for the troops. So inserting language into it can be a way to pass proposals that might not stand on their own. But there’s also a risk of a backlash—especially if a measure is seen as unrelated to the military. This may be why Trump has started claiming that Section 230 is a “threat to our national security,” since that would theoretically make it germane to a defense funding bill.

Trump’s campaign to repeal Section 230 appears to go beyond mere tweets. The White House is reportedly telling members of Congress the same thing in private that the president is telling his 88 million Twitter followers: that he will veto the NDAA if it doesn’t repeal or at least overhaul Section 230.

Repealing Section 230 could throw the Internet into chaos

Section 230 has two key provisions. One states that an online service provider can’t be treated as the publisher of content created by a third party. The second provision says that a provider can’t be held liable for taking down content it “considers to be obscene, lewd, lascivious, filthy, excessively violent, harassing, or otherwise objectionable.” The inclusion of “otherwise objectionable” in this list gives online platforms essentially bulletproof protection against lawsuits for removing third-party content.

Trump’s focus on Section 230 seems to be driven by anger that online platforms—especially Twitter—have labeled or removed his posts when they violate their policies. In May, Twitter slapped a warning label on a Trump tweet exaggerating the risks of voter fraud. Soon afterward, Trump signed an executive order asking the FCC to reinterpret Section 230. He’s been tweeting angrily about the law ever since.

Trump presumably hopes that repealing Section 230 would force Twitter to take a more hands-off approach. But there’s no guarantee that would happen. Fundamentally, Twitter’s right to label or remove tweets doesn’t flow from Section 230, it comes from the First Amendment. Like anyone else in American society, Twitter has a First Amendment right to decide what information it will host on its own website.

It’s hard to predict what would happen if Congress takes Trump’s demand literally and “completely terminated” Section 230. Because Section 230 has been on the books almost as long as the consumer Internet has existed, there are very few precedents governing the liability of online platforms in a world without Section 230.

The few precedents that did exist before the 1996 passage of Section 230 had held that platforms that moderated user content were more liable for that content than platforms that took a hands-off approach. This created a perverse incentive for platforms not to moderate user content at all. So one possible consequence of repealing Section 230 would be to force online platforms to take a more hands-off approach to content moderation—including Trump’s tweets.

But it’s hard to see how this would deter Twitter from labeling Trump tweets as inaccurate. And it seems more likely that things would go in the opposite direction: that big platforms, unwilling to give up moderation altogether, would be forced to filter content more aggressively. Platforms that wanted to continue moderating might decide that they need to take down anything that seems potentially libelous—like Trump’s May tweet baselessly insinuating that television host Joe Scarborough murdered one of his employees.

It’s also possible that courts would recognize the perversity of this 25-year-old rule and fashion a different set of liability rules that didn’t penalize sites that made good-faith attempts to remove objectionable content. In that case, predicting what rules would govern a post-Section 230 Internet is difficult. But there’s no reason to think it would force online platforms to become more accommodating to Republican politicians.

One thing that’s certain is that a repeal of Section 230 would create a lot of uncertainty for US Internet businesses—not only online giants but anyone who runs a blog with a comment section. Many sites might just shut down their comment sections rather than deal with the legal headaches.

Members of Congress probably realize this, and they may refuse to throw the Internet into chaos just to indulge Trump’s anger at Twitter.

Trump probably won’t get what he wants

Of course, Congress could overhaul Section 230 rather than repealing it outright. Several members of Congress have proposed Section 230 reform bills. One ham-fisted proposal by Sen. Josh Hawley (R-Mo.) would allow large technology companies to keep their immunity only if they could convince four out of five Federal Trade Commissioners that their moderation policies were “content neutral.” Conservative writer David French dismissed Hawley’s bill as an “unconstitutional mess.”

A more serious proposal—and one that’s reportedly getting serious consideration on Capitol Hill—comes from Sen. Roger Wicker (R-Miss.). His bill deletes the phrase “or otherwise objectionable” from Section 230. That means sites would only get immunity for content-removal decisions if the removed content fell under the other enumerated categories, including content that is “obscene,” “excessively violent,” or “harassing.” Wicker also adds a few new categories to this list, including “promoting terrorism.”

How significant this shift would be in practice is unclear. Under Wicker’s proposal, sites still couldn’t be considered the publisher of material submitted by third parties. That provides online platforms with pretty broad immunity all on its own. And the Wicker bill wouldn’t make removing any types of content illegal. It just wouldn’t offer immunity for as many takedowns as current law does.

And in most cases, it’s simply not illegal for a website owner to remove third-party content—even if they do so in a manner that is arbitrary or politically biased. Twitter would probably still have the right to remove Trump’s tweets if it wanted to—and it could certainly continue adding labels debunking Trump’s claims.

The outcome that seems most likely is that Congress simply ignores Trump’s threats. With less than two months remaining in his presidency, Trump doesn’t have much leverage. He hasn’t put a clear proposal on the table, which will make it harder for Republican members of Congress to give him what he wants. Meanwhile, Democrats have shown no inclination to accommodate Trump’s demands.

“I’d like to start for the Blazers, but that’s not going to happen either,” tweeted Sen. Ron Wyden (D-Ore.), the original co-author of Section 230.

https://arstechnica.com/?p=1726969

The Supreme Court on Monday considered how broadly to interpret the Computer Fraud and Abuse Act, America’s main anti-hacking statute.

Here’s how I described the case back in September:

The case arose after a Georgia police officer named Nathan Van Buren was caught taking a bribe to look up confidential information in a police database. The man paying the bribe had met a woman at a strip club and wanted to confirm that she was not an undercover cop before pursuing a sexual—and presumably commercial—relationship with her.

Unfortunately for Van Buren, the other man was working with the FBI, which arrested Van Buren and charged him with a violation of the CFAA. The CFAA prohibits gaining unauthorized access to a computer system—in other words, hacking—but also prohibits “exceeding authorized access” to obtain data. Prosecutors argued that Van Buren “exceeded authorized access” when he looked up information about the woman from the strip club.

But lawyers for Van Buren disputed that. They argued that his police login credentials authorized him to access any data in the database. Offering confidential information in exchange for a bribe may have been contrary to department policy and state law, they argued, but it didn’t “exceed authorized access” as far as the CFAA goes.

Obviously, no one is going to defend a cop allegedly accepting bribes to reveal confidential government information. But the case matters because the CFAA has been invoked in prosecutions of more sympathetic defendants. For example, prosecutors used the CFAA to prosecute Aaron Swartz for scraping academic papers from the JSTOR database. They also prosecuted a small company that used automated scraping software to purchase and resell blocks of tickets from the TicketMaster website.

The CFAA allows for civil as well as criminal penalties. For example, LinkedIn sued a small data-analytics company for scraping data from its website. Last year, the 9th Circuit Appeals Court rejected the lawsuit, holding that the CFAA was intended to address computer hacking, not conduct that merely violated a site’s terms of service.

In short, the core issue in the case was when—if ever—violating the terms of use of a website or other computer system can lead to legal trouble. While the CFAA has been on the books since the 1980s, the nation’s highest court has never addressed the question.

On Monday, the court’s nine justices seemed to have a range of views on the question. Some seemed ready to accept the government’s broad reading of the statute, while others worried that doing so could criminalize a lot of innocuous online activity.

“Parade of horribles”

The core of Van Buren’s argument is that, if he is convicted, it could open the door to criminal prosecution of others engaged in more innocuous conduct.

“This construction would brand most Americans criminals on a daily basis,” Jeff Fisher, the defendant’s lawyer, said during Monday oral arguments conducted over Zoom. “Imagine a secretary whose employee handbook says that her email or Zoom account may be used only for business purposes. Or consider a person using a dating website, where users may not include false information in their profile to obtain information about potential mates. Or think of a law student who is issued login credentials for Westlaw or Lexis for educational uses only.

“If the government is right, then a computer user who disregards any of these stated use restrictions commits a federal crime,” Fisher continued. “For example, any employee who used a Zoom account over Thanksgiving to connect with distant relatives would be subject to the grace of federal prosecutors.”

These kinds of hypotheticals—dubbed a “parade of horribles”—came up over and over again in Monday’s argument over Zoom. Much of Monday’s argument focused on whether the government’s position would open the floodgates to federal prosecutions in these kinds of cases.

The government took a surprising position

Eric Feigin, the attorney representing the Department of Justice, rejected Fisher’s parade of horribles, arguing that none of Fisher’s scenarios would actually lead to federal prosecution. He argued that when the law talks about “authorized access,” it didn’t mean to cover public websites—even websites that require a username and password.

“What Congress was aiming at here were people who were specifically trusted—people akin to employees, the kind of person who has actually been specifically considered and individually authorized,” Feigin said on Monday. Under his theory, someone who broke the rules of a dating website or a social media platform wouldn’t be covered by the CFAA no matter what they did.

But Justice Stephen Breyer seemed surprised by Feigin’s argument.

“There are dozens and dozens and dozens of sites where they say you may enter this site and use the information here if you agree to the terms of access. And then you have a big list in small print that goes on for quite a long ways. I take it what would be covered in the terms of access would be what’s permitted and what isn’t. Authorized and not. Correct?”

Feigin disagreed, arguing that the CFAA’s “authorization” was required only when someone had been granted “specific, individualized permission.”

This seems hard to square with past CFAA cases. TicketMaster’s website, for example, is available to the general public. People who purchase tickets there aren’t “akin to employees.” Yet people got prosecuted for scraping it. Similarly, JSTOR doesn’t hand-pick who is allowed to access academic articles—yet Swartz was prosecuted for downloading them without authorization.

And there have been several CFAA lawsuits based on information from public websites. In a 2008 lawsuit, for example, Facebook sued a startup called Power Ventures for using the credentials of its users—with their permission—to send messages through Facebook’s messaging platform. Power Ventures ultimately lost that case, but it seems like under Feigin’s logic the CFAA shouldn’t have applied at all, since Facebook offers accounts to anyone who wants one (aside from young children).

In another case, Craigslist successfully sued a competitor called 3taps under the CFAA for scraping classified ads and offering them in an alternative format. In this case, the content at issue was freely available to the public without even a username and password. Yet a judge held that 3taps had “exceeded authorized access” under the CFAA when it ignored cease-and-desist letters from Craigslist.

When Justice Samuel Alito asked Feigin about the TicketMaster case, Feigin dismissed it because the defendants had “hired Bulgarian hackers to circumvent some technological limitations”—an apparent reference to the defendants’ efforts to circumvent TicketMaster’s CAPTCHAs and other efforts to prevent scraping. But it seems like, under the government’s current theory, the CFAA shouldn’t have applied at all.

“I’ve never heard DOJ’s proposals before”

The government’s position left some legal scholars scratching their heads.

“Until this case, everyone up to now, including [the Department of Justice], has agreed that the statute is incredibly broad other than the matter of authorization,” wrote Orin Kerr, a legal scholar who supports a narrow reading of the law. “In this case, though, DOJ rejects DOJ’s past views on this. Not just rejects, but mocks as utterly ridiculous, pure fantasy.”

“Beyond being inconsistent with DOJ’s past positions, DOJ’s new views don’t seem to have a textual basis in the statute,” Kerr added. “I’ve never heard DOJ’s proposals before I read their brief, and I’ve been living this stuff, including while at DOJ, for over 20 years.”

In a sense, this leaves the Supreme Court with two different ways to limit the scope of the CFAA. One way—the way favored by the defendant—would be to hold that violating a site’s terms of use doesn’t violate the law, even in egregious cases. The other option—the one now favored by the government—is to hold that violating a site’s terms of use is only a federal crime if it’s a site that provides sensitive private information and tightly limits who can access it.

If the Supreme Court chooses this latter option, the change to the way the CFAA is interpreted could actually wind up being larger. It would expose defendants to criminal penalties if they made inappropriate use of certain types of online databases. But it could largely neuter the CFAA when it comes to information on public websites. Companies like Facebook, Craigslist, and LinkedIn could wind up with less, not more, power over how people use their sites.

Monday’s oral arguments didn’t give much indication of how the court would rule. A few justices—Sotomayor, Gorsuch, and possibly Breyer—seemed ready to side with defendants. A couple of others—Thomas and Barrett—seemed sympathetic to the government’s position. But the others held their views close to their vests—and justices’ questions don’t necessarily predict how they will ultimately rule. Sometimes justices ask tougher questions of the side they favor to make sure they aren’t missing any important counterarguments.

https://arstechnica.com/?p=1726430

The Tor anonymity network has generated controversy almost constantly since its inception almost two decades ago. Supporters say it’s a vital service for protecting online privacy and circumventing censorship, particularly in countries with poor human rights records. Critics, meanwhile, argue that Tor shields criminals distributing child-abuse images, trafficking in illegal drugs, and engaging in other illicit activities.

Researchers on Monday unveiled new estimates that attempt to measure the potential harms and benefits of Tor. They found that, worldwide, almost 7 percent of Tor users connect to hidden services, which the researchers contend are disproportionately more likely to offer illicit services or content compared with normal Internet sites. Connections to hidden services were significantly higher in countries rated as more politically “free” relative to those that are “partially free” or “not free.”

Licit versus illicit

Specifically, the fraction of Tor users globally accessing hidden sites is 6.7, a relatively small proportion. Those users, however, aren’t evenly distributed geographically. In countries with regimes rated “not free” by this scoring from an organization called Freedom House, access to hidden services was just 4.8 percent. In “free” countries, the proportion jumped to 7.8 percent.

Here’s a graph of the breakdown:

In a paper, the researchers wrote:

The Tor anonymity network can be used for both licit and illicit purposes. Our results provide a clear, if probabilistic, estimation of the extent to which users of Tor engage in either form of activity. Generally, users of Tor in politically “free” countries are significantly more likely to be using the network in likely illicit ways. A host of additional questions remain, given the anonymous nature of Tor and other similar systems such as I2P and Freenet. Our results narrowly suggest, however, users of Tor in more repressive “not free” regimes tend to be far more likely to venture via the Tor network to Clear Web content and so are comparatively less likely to be engaged in activities that would be widely deemed malicious.

The estimates are based on a sample comprising 1 percent of Tor entry nodes, which the researchers monitored from December 31, 2018 to August 18, 2019, with an interruption to data collection from May 4 to May 13. By analyzing directory lookups and other unique signatures in the traffic, the researchers distinguished when a Tor client was visiting normal Internet websites or anonymous (or Dark Web) services.

The researchers—from Virginia Tech in Blacksburg, Virginia; Skidmore College in Saratoga Springs, New York; and Cyber Espion in Portsmouth, United Kingdom—acknowledged that the estimates aren’t perfect, In part, that’s because the estimates are based on the unprovable assumption that the overwhelming majority of Dark Web sites provide illicit content or services.

The paper, however, argues that the findings can be useful for policymakers who are trying to gauge the benefits of Tor relative to the harms it creates. The researchers view the results through the lenses of the 2015 paper titled The Dark Web Dilemma: Tor, Anonymity and Online Policing and On Liberty, the essay published by English philosopher John Stuart Mill in 1859.

Dark Web dilemma

The researchers in Monday’s paper wrote:

These results have a number of consequences for research and policy. First, the results suggest that anonymity-granting technologies such as Tor present a clear public policy challenge and include clear political context and geographical components. This policy challenge is referred to in the literature as the “Dark Web dilemma.” At the root of the dilemma is the so-called “harm principle” proposed in On Liberty by John Stuart Mill. In this principle, it is morally permissible to undertake any action so long as it does not cause someone else harm.

The challenge of the Tor anonymity network, as intimated by its dual use nature, is that maximal policy solutions all promise to cause harm to some party. Leaving the Tor network up and free from law enforcement investigation is likely to lead to direct and indirect harms that result from the system being used by those engaged in child exploitation, drug exchange, and the sale of firearms, although these harms are of course highly heterogeneous in terms of their potential negative social impacts and some, such as personal drug use, might also have predominantly individual costs in some cases.

Conversely, simply working to shut down Tor would cause harm to dissidents and human rights activists, particularly, our results suggest, in more repressive, less politically free regimes where technological protections are often needed the most.

Our results showing the uneven distribution of likely licit and illicit users of Tor across countries also suggest that there may be a looming public policy conflagration on the horizon. The Tor network, for example, runs on ∼6,000–6,500 volunteer nodes. While these nodes are distributed across a number of countries, it is plausible that many of these infrastructural points cluster in politically free liberal democratic countries. Additionally, the Tor Project, which manages the code behind the network, is an incorporated not for profit in the United States and traces both its intellectual origins and a large portion of its financial resources to the US government.

In other words, much of the physical and protocol infrastructure of the Tor anonymity network is clustered disproportionately in free regimes, especially the United States. Linking this trend with a strict interpretation of our current results suggests that the harms from the Tor anonymity network cluster in free countries hosting the infrastructure of Tor and that the benefits cluster in disproportionately highly repressive regimes.

A “flawed” assumption

It didn’t take long for people behind the Tor Project to question the findings and the assumptions that led to them. In an email, Isabela Bagueros, executive director of the Tor Project, wrote:

The authors of this research paper have chosen to categorize all .onion sites and all traffic to these sites as “illicit” and all traffic on the “Clear Web” as ‘licit.’

This assumption is flawed. Many popular websites, tools, and services use onion services to offer privacy and censorship-circumvention benefits to their users. For example, Facebook offers an onion service. Global news organizations, including The New York Times, BBC, Deutsche Welle, Mada Masr, and Buzzfeed, offer onion services.

Whistleblowing platforms, filesharing tools, messaging apps, VPNs, browsers, email services, and free software projects also use onion services to offer privacy protections to their users, including Riseup, OnionShare, SecureDrop, GlobaLeaks, ProtonMail, Debian, Mullvad VPN, Ricochet Refresh, Briar, and Qubes OS.

(For even more examples, and quotes from website admins that use onion services on why they use Tor: https://blog.torproject.org/more-onions-end-of-campaign)

Writing off traffic to these widely-used sites and services as “illicit” is a generalization that demonizes people and organizations who choose technology that allows them to protect their privacy and circumvent censorship. In a world of increasing surveillance capitalism and internet censorship, online privacy is necessary for many of us to exercise our human rights to freely access information, share our ideas, and communicate with one another. Incorrectly identifying all onion service traffic as “illicit” harms the fight to protect encryption and benefits the powers that be that are trying to weaken or entirely outlaw strong privacy technology.

Secondly, we look forward to hearing the researchers describe their methodology in more detail, so the scientific community has the possibility to assess whether their approach is accurate and safe. The copy of the paper provided does not outline their methodology, so there is no way for the Tor Project or other researchers to assess the accuracy of their findings.

The paper is unlikely to convert Tor supporters to critics or vice versa. It does, however, provide a timely estimate of overall Tor usage and geographic breakdown that will be of interest to many policymakers.

https://arstechnica.com/?p=1726503