President Donald Trump has fired Chris Krebs, the head of the Cybersecurity and Infrastructure Security Agency, the president announced Tuesday on Twitter. Krebs’ firing has been widely expected after Krebs repeatedly disputed claims that election fraud was responsible for Trump’s loss in this month’s presidential election.

“The recent statement by Chris Krebs on the security of the 2020 Election was highly inaccurate, in that there were massive improprieties and fraud,” Trump tweeted. Trump claimed, without offering evidence, that there had been “dead people voting,” “poll watchers not allowed into polling locations,” and “glitches in voting machines that changed votes from Trump to Biden.”

In the two weeks since the election, Krebs and his agency have energetically disputed claims like these. The agency set up a “rumor control” site that listed common fraud claims and then argued that they were bogus. For example, it responded to concerns about dead people voting by stating that “voter registration list maintenance and other election integrity measures protect against voting illegally on behalf of deceased individuals.”

“Please don’t retweet wild and baseless claims about voting machines, even if they’re made by the president,” wrote election security expert David Becker in a tweet last week. Krebs retweeted this tweet from his official CISA Twitter account.

Krebs fully expected his confrontational approach to cause friction with the president. Last Thursday, Reuters reported that Krebs expected Trump to fire him. According to Reuters, the White House had been pressuring CISA to take down material debunking fraud rumors, but the agency had refused.

As it now does regularly, Twitter labeled Trump’s tweet announcing Krebs’ firing. “This claim about election fraud is disputed,” the label said.

On Monday, dozens of computer security experts signed a letter disputing claims that hackers had altered the results of the 2020 election.

“We are aware of alarming assertions being made that the 2020 election was ‘rigged’ by exploiting technical vulnerabilities,” the letter said. “However, in every case of which we are aware, these claims either have been unsubstantiated or are technically incoherent. To our collective knowledge, no credible evidence has been put forth that supports a conclusion that the 2020 election outcome in any state has been altered through technical compromise.”

https://arstechnica.com/?p=1723955

GitHub has reversed its decision to boot YouTube-dl, a popular tool for archiving YouTube videos, from its platform. The company restored repositories this week after “additional information” convinced it that an archiving tool is not in and of itself a copyright violation—no matter what the music industry says.

The repositories in question got shut down in late October before coming back yesterday. “We share developers’ frustration with this takedown—especially since this project has many legitimate purposes,” GitHub explained in a corporate blog post. “Our actions were driven by processes required to comply with laws like the DMCA that put platforms like GitHub and developers in a difficult spot. And our reinstatement, based on new information that showed the project was not circumventing a technical protection measure (TPM), was inline with our values of putting developers first.”

The initial takedown occurred after the Recording Industry Association of America filed a claim with Microsoft-owned GitHub arguing that the code in those repositories was inherently illegal under US copyright law. At a high level, the law in question basically makes it illegal to crack or bypass DRM in any way, except for a handful of enumerated exemptions.

The RIAA’s takedown filing argued not that YouTube-dl was itself infringing content. Instead, the filing alleges that the code violated that section of copyright law because, in the RIAA’s eyes, “the clear purpose of this source code is to… circumvent the technological protection measures used by authorized streaming services such as YouTube, and [to] reproduce and distribute music videos and sound recordings owned by our member companies without authorization for such use.”

Not exactly

The “additional information” GitHub received about the RIAA’s claim came from the Electronic Frontier Foundation, which filed a response to GitHub on behalf of the developers maintaining YouTube-dl.

First of all, the EFF pointed out, the RIAA’s claim that YouTube-dl only exists for piracy is flat-out wrong—the utility has a host of legal, fair-use applications:

[YouTube-dl] has a vast, diverse, worldwide community of users. It is used by journalists and human rights organizations to save eyewitness videos, by educators to save videos for classroom use, by YouTubers to save backup copies of their own uploaded videos, and by users worldwide to watch videos on hardware that can’t run a standard web browser, or to watch videos in their full resolution over slow or unreliable Internet connections.

Secondly, and even more pertinent to the RIAA’s claim: YouTube-dl does not in fact circumvent DRM in place on videos. Instead, the utility does roughly the same thing any Web browser would, the EFF explains: “It reads and interprets the JavaScript program sent by YouTube, derives the ‘signature’ value, and sends that value back to YouTube to initiate the video stream.” (The EFF creatively compares this to the Doors of Durin in The Lord of the Rings, which say, “speak, friend, and enter.” Providing the signature is, in this case, analogous to knowing the Sindarin word for “friend.”)

This mechanism, the EFF argues, is not “circumvention” in legal terms. YouTube-dl merely accesses the “signature” code, rather than bypassing or avoiding it, and “any alleged lack of authorization from YouTube or the RIAA is irrelevant.”

GitHub found the EFF’s arguments compelling. After reading over the filing, GitHub determined that the RIAA’s claims “did not establish a violation of the law.”

Doing better next time

As a result of the YouTube-dl fiasco, GitHub has promised changes to its claim-review process going forward. For starters, new claims will be reviewed by both technical and legal experts—the techies to determine if the code actually does what the claimant says it does, and the lawyers to determine if the claim does in fact fall within the boundaries of the law.

When the claim is ambiguous, “We will err on the side of the developer,” GitHub says. And even if a claim is found to be accurate, legal, and technically legitimate, the repository owner will get a chance to make changes or respond to the claim before their repository is taken down.

Perhaps most interestingly, GitHub is putting its money where its proverbial mouth is: the company is donating $1 million to establish a “developer defense fund” to help developers fight against unwarranted legal claims.

GitHub CEO Nat Friedman added in a Twitter thread that GitHub “will have more to say about this, and other things we are doing to protect developers and their freedom to tinker, in the coming weeks.”

https://arstechnica.com/?p=1723734

One of the Trump administration’s top coronavirus advisers called for Michigan residents to “rise up” against their state government to resist temporary coronavirus mitigation measures—barely one month after several men were arrested for conspiring to kidnap and assassinate the state’s governor.

Michigan Gov. Gretchen Whitmer’s administration on Sunday issued a new emergency order putting a “pause” on several nonessential businesses and activities for the next three weeks. The order closes casinos and movie theaters, halts in-person dining in bars and restaurants, and requires colleges and high schools to return to all-virtual education, among other limitations. Childcare and schools up through eighth grade can remain open, as can gyms and pools, retail locations, and personal care services such as hair salons. Gatherings of up to 25 people are also permitted outdoors.

“Right now, there are thousands of cases a day, and hundreds of deaths a week in Michigan, and the number is growing,” Whitmer said when announcing the order. “If we don’t act now, thousands more will die, and our hospitals will continue to be overwhelmed. We can get through this together by listening to health experts once again and taking action right now to slow the spread of this deadly virus.”

Scott Atlas, who joined the Trump administration’s COVID response team in August, responded by urging a stop not to the virus, but to the government trying to mitigate its spread. “The only way this stops is if people rise up,” Atlas said in a tweet. “You get what you accept. #FreedomMatters #StepUp.”

Three hours later, after receiving a negative response to his initial tweet, Atlas added, “I NEVER was talking at all about violence. People vote, people peacefully protest. NEVER would I endorce or incite violence.” Atlas did not, however, walk back the idea that people should vigorously fight against any coronavirus-related restrictions.

The violence is already here

The language in Atlas’ tweet would be troubling aimed at any state or federal official, but targeting the Whitmer administration strikes a particular nerve. Federal and state law enforcement on October 8 arrested more than a dozen men on charges related to a plot to kidnap and kill Gov. Whitmer.

Eight of the men who were arrested as part of that alleged conspiracy had attended previous demonstrations against the Whitmer administration’s anti-COVID measures, including a heavily armed demonstration inside the Michigan capitol building in April. Rhetoric from the Trump administration has made the threats of violence worse.

“Every time the president ramps up this violent rhetoric, every time he fires up Twitter to launch another broadside against me, my family and I see a surge of vicious attacks sent our way,” Whitmer wrote in an essay in The Atlantic. The same seems likely to follow such rhetoric from other members of the administration as well.

“We know that the White House likes to single us out here in Michigan, me out in particular,” Whitmer told CNN late Sunday. “I’m not going to be bullied into not following reputable scientists and medical professionals.”

Disreputable scientists

In addition to the frightening implications of violence, Atlas’ call to fight COVID-19 countermeasures comes exactly when the United States needs those measures more than ever.

The country is in the midst of a dramatic surge of cases in almost every state. Just one week ago, the US crossed the 10 million-case threshold; today, that number already exceeds 11 million and is continuing to rise.

The Midwest region is being particularly hard hit at the moment, and Michigan is no exception. According to data compiled by The New York Times, the number of reported cases, COVID-related hospitalizations, and COVID-related deaths have all more than doubled over the past two weeks, and hospitals in several states are already at capacity. Taking steps to reduce the spread of the coronavirus should be common sense at this point.

Unfortunately, this sort of anti-science stance is par for the course for Atlas, who joined the Trump team this summer as the “anti-Dr. Fauci.”

In August, he advocated for simply letting the virus run rampant to generate “herd immunity,” a plan that amounts to giving up and letting hundreds of thousands of people die. The White House endorsed that position in October.

Michigan Attorney General Dana Nessel said Atlas’ “rise up” statement is “disappointing, irresponsible, and the reason why the United States finds itself in such desperate circumstances regarding COVID-19.” Nessel added, “COVID-19 is the enemy, not each other. Stop pitting Americans against each other and start supporting policies proven to effectively fight the virus.”

https://arstechnica.com/?p=1723462

The US government’s chief information security officer (CISO) is taking time off from his official duties to help President Trump’s so-far-fruitless search for election fraud.

Camilo Sandoval worked on Trump’s 2016 campaign and has been the federal CISO, a position in the White House’s Office of Management and Budget, since October of this year. But Sandoval is now spending his days working for the newly formed Voter Integrity Fund, which is reportedly “run by government employees and former Trump campaign staffers who are analyzing voter data in six key states.”

Ethics rules require federal employees to keep political activity and government work separate. Sandoval said he isn’t breaking any rules, The Washington Post reported yesterday:

In an interview on Friday, Sandoval defended his involvement in the endeavor as appropriate, saying he had taken vacation time from his government position, which he started last month. He said he was not using any government resources, such as his work computer or cellphone, while searching for fraud.

“I am doing this in my private capacity, just as many others have done in past elections,” he said. “I think it’s pretty clear that this is acceptable and normal.”

A spokeswoman for the White House Office of Management and Budget, where Sandoval works, said Friday that Sandoval was on leave, but she did not respond when asked whether he was continuing to receive his government salary.

The federal CISO position was created in 2016 by the Obama White House “to drive cybersecurity policy, planning, and implementation across the Federal Government.” Sandoval filled an opening created a few months ago when CISO Grant Schneider left the job after nearly three decades in the federal government.

US agency debunked election-fraud claims

Sandoval is not likely to find extensive evidence of voter fraud, let alone enough to change the results of the presidential election. Democrat Joe Biden is on track to beat Trump in the electoral college by a count of 306-232—the same margin that Trump called a “massive landslide” when he won election in 2016—and Biden has clear leads in states where Trump would need to change the results.

Trump today continued to push his baseless election-fraud conspiracy theory, tweeting that “Radical Left Democrats” are partnering with “the Fake News Media” to “STEAL this Election.” But the election on November 3 “was the most secure in American history,” according to a statement by two election-oversight committees published Thursday on the US Cybersecurity and Infrastructure Security Agency (CISA) website. Ongoing recounts may turn up some mistakes, but “there is no evidence that any voting system deleted or lost votes, changed votes, or was in any way compromised,” the statement said.

The CISA also set up a “rumor control” page to debunk election misinformation despite pressure from White House officials.

Cold-calling voters

Sandoval was director of data operations for Trump’s 2016 campaign and then worked in the Trump administration in the Treasury Department and Department of Veterans Affairs. Sandoval’s 2018 appointment to be chief information officer of Veterans Affairs was opposed by 11 Democratic members of Congress. “This appointment raises serious data security concerns stemming from Mr. Sandoval’s previous position as the Director of Data Operations in 2016 while the Trump campaign was contracting with Cambridge Analytica,” the congressional Democrats wrote. “Cambridge Analytica’s misuse of personal information from tens of millions of Americans, including veterans, was an incredible breach of trust.”

Sandoval was also facing a sexual-harassment lawsuit and apparently had “a history of rampant interpersonal conflicts with co-workers,” the Democrats wrote at the time.

The Voter Integrity Fund that Sandoval now works for “is analyzing ballot data and cold-calling voters in an attempt to substantiate the president’s outlandish claims about illicit voting,” The Washington Post wrote. The group is led by Matthew Braynard, a data specialist on Trump’s 2016 campaign, who told the Post that several other government officials also took leave to work on the effort to find election fraud. One of them is Thomas Baptiste, an adviser in the Interior Department. The group has raised over $640,000 in donations.

“Braynard and Sandoval claim that they have found evidence of possible fraud, but they have yet to make any detailed findings public,” the Post wrote. According to The Philadelphia Inquirer, “Braynard said the group was formed independently of the Trump campaign, but that it is in frequent communication with it. He said they have provided the campaign and its team of lawyers with information on voters for their legal battles.”

Sandoval did not go so far as to say that the election was stolen from Trump. But he told the Post, “we are going to be asking for weeks and months who really won, and was there fraud, and if I can use my skills to help bring transparency to that, then it is worthwhile.”

According to the Inquirer, the Voter Integrity Fund has been calling voters and asking, “Did a person with your name vote? Did you request a mail-in ballot? Did you return a mail-in ballot?” The group’s plan is to contact about 1.5 million people.

“I’m pretty upset that these agents of misinformation were able to get my phone number and basically bother me to help create their phony panic,” voter Marc Faletti of Philadelphia told the Inquirer.

https://arstechnica.com/?p=1723473

When the notion of enlisting smartphones to help fight the COVID-19 pandemic first surfaced last spring, it sparked a months-long debate: should apps collect location data, which could help with contact tracing but potentially reveal sensitive information? Or should they take a more limited approach, only measuring Bluetooth-based proximity to other phones? Now, a broad survey of hundreds of COVID-19-related apps reveals that the answer is all of the above. And that has made the COVID-19 app ecosystem a kind of wild, sprawling landscape, full of potential privacy pitfalls.

Late last month, Jonathan Albright, director of the Digital Forensics Initiative at the Tow Center for Digital Journalism, released the results of his analysis of 493 COVID-19-related iOS apps across dozens of countries. His study of those apps, which tackle everything from symptom-tracking to telehealth consultations to contact tracing, catalogs the data permissions each one requests. At WIRED’s request, Albright then broke down the dataset further to focus specifically on the 359 apps that handle contact tracing, exposure notification, screening, reporting, workplace monitoring, and COVID-19 information from public health authorities around the globe.

The results show that only 47 of that subset of 359 apps use Google and Apple’s more privacy-friendly exposure-notification system, which restricts apps to only Bluetooth data collection. More than six out of seven COVID-19-focused iOS apps worldwide are free to request whatever privacy permissions they want, with 59 percent asking for a user’s location when in use and 43 percent tracking location at all times. Albright found that 44 percent of COVID-19 apps on iOS asked for access to the phone’s camera, 22 percent of apps asked for access to the user’s microphone, 32 percent asked for access to their photos, and 11 percent asked for access to their contacts.

“It’s hard to justify why a lot of these apps would need your constant location, your microphone, your photo library,” Albright says. He warns that, even for COVID-19-tracking apps built by universities or government agencies—often at the local level—that introduces the risk that private data, sometimes linked with health information, could end up out of users’ control. “We have a bunch of different, smaller public entities that are more or less developing their own apps, sometimes with third parties. And we don’t know where the data’s going.”

The relatively low number of apps that use Google and Apple’s exposure-notification API compared to the total number of COVID-19 apps shouldn’t be seen as a failure of the companies’ system, Albright points out. While some public health authorities have argued that collecting location data is necessary for contact tracing, Apple and Google have made clear that their protocol is intended for the specific purpose of “exposure notification”—alerting users directly to their exposure to other users who have tested positive for COVID-19. That excludes the contact tracing, symptom checking, telemedicine, and COVID-19 information and news that other apps offer. The two tech companies have also restricted access to their system to public health authorities, which has limited its adoption by design.

“Almost as bad as what you’d expect”

But Albright’s data nonetheless shows that many US states, local governments, workplaces, and universities have opted to build their own systems for COVID-19 tracking, screening, reporting, exposure alerts, and quarantine monitoring, perhaps in part due to Apple and Google’s narrow focus and data restrictions. Of the 18 exposure-alert apps that Albright counted in the United States, 11 use Google and Apple’s Bluetooth system. Two of the others are based on a system called PathCheck Safeplaces, which collects GPS information but promises to anonymize users’ location data. Others, like Citizen Safepass and the CombatCOVID app used in Florida’s Miami-Dade and Palm Beach counties, ask for access to users’ location and Bluetooth proximity information without using Google and Apple’s privacy-restricted system. (The two Florida apps asked for permission to track the user’s location in the app itself, strangely, not in an iOS prompt.)

But those 18 exposure-notification apps were just part of a larger category of 45 apps that Albright classified as “screening and reporting” apps, whose functions range from contact tracing to symptom logging to risk assessment. Of those apps, 24 asked for location while the app was in use, and 20 asked for location at all times. Another 19 asked for access to the phone’s camera, 10 asked for microphone access, and nine asked for access to the phone’s photo library. One symptom-logging tool called CovidNavigator inexplicably asked for users’ Apple Music data. Albright also examined another 38 “workplace monitoring” apps designed to help keep COVID-19-positive employees quarantined from coworkers. Half of them asked for location data when in use, and 13 asked for location data at all times. Only one used Google and Apple’s API.

“In terms of permissions and in terms of the tracking built in, some of these apps seem to be almost as bad as what you’d expect from a Middle Eastern country,” Albright says.

493 apps

Albright assembled his survey of 493 COVID-19-related apps with data from apps analytics firms 41matters, AppFigures, and AppAnnie, as well as by running the apps himself while using a proxied connection to monitor their network communications. In some cases, he sought out public information from app developers about functionality. (He says he restricted his study to iOS rather than Android because there have been previous studies that focused exclusively on Android and raised similar privacy concerns, albeit while surveying far fewer apps.) Overall, he says the results of his survey don’t point to any necessarily nefarious activity, so much as a sprawling COVID-19 app marketplace where private data flows in unexpected and less than transparent directions. In many cases, users have little choice but to use the COVID-19 screening app that’s implemented by their college or workplace and no alternative to whatever app their state’s health authorities ask users to adopt.

When WIRED reached out to Apple for comment, the company responded in a statement that it carefully vets all iOS apps related to COVID-19—including those that don’t use its exposure-notification API—to make sure they’re being developed by reputable organizations like government agencies, health NGOs, and companies credentialed in health issues or medical and educational institutions as well as to ensure they’re not deceptive in their requests for data. In iOS 14, Apple notes that users are warned with an indicator dot at the top of their screen when an app is accessing their microphone or camera and lets users choose to share approximate rather than fine-grained locations with apps.

But Albright notes that some COVID-19 apps he analyzed went beyond direct requests for permission to monitor the user’s location to include advertising analytics, too: while Albright didn’t find any advertising-focused analytic tools built into exposure-notification or contact-tracing apps, he found that, among apps he classifies as “information and updates,” three used Google’s ad network and two used Facebook Audience Network, and many others integrated software development kits for analytics tools including Branch, Adobe Auditude, and Airship. Albright warns that any of those tracking tools could potentially reveal users’ personal information to third-party advertisers, including potentially even users’ COVID-19 status. (Apple noted in its statement that starting this year, developers will be required to provide information about both their own privacy practices and those of any third parties whose code they integrate into their apps to be accepted into the app store.)

“Collect data and then monetize it”

Given the rush to create COVID-19-related apps, it’s not surprising that many are aggressively collecting personal data and, in some cases, seeking to profit from it, says Ashkan Soltani, a privacy researcher and former Federal Trade Commission chief technologist. “The name of the game in the apps space is to collect data and then monetize it,” Soltani says. “And there is essentially an opportunity in the marketplace because there’s so much demand for these types of tools. People have COVID-19 on the brain and therefore developers are going to fill that niche.”

Soltani adds that Google and Apple, by allowing only official public health authorities to build apps that access their exposure-notification API, built a system that drove other developers to build less restricted, less privacy-preserving COVID-19 apps. “I can’t go and build an exposure-notification app that uses Google and Apple’s system without some consultation with public health agencies,” Soltani says. “But I can build my own random app without any oversight other than the App Store’s approval.”

Concerns of data misuse apply to official channels as well. Just in recent weeks, the British government has said it will allow police to access contact-tracing information and in some cases issue fines to people who don’t self-isolate. And after a public backlash, the Israeli government walked back a plan to share contact-tracing information with law enforcement so it could be used in criminal investigations.

Not necessarily nefarious

Apps that ask for location data and collect it in a centralized way don’t necessarily have shady intentions. In many cases, knowing at least elements of an infected person’s location history is essential to effective contact tracing, says Mike Reid, an infectious disease specialist at UCSF, who is also leading San Francisco’s contact-tracing efforts. Google and Apple’s system, by contrast, prioritizes the privacy of the user but doesn’t share any data with health agencies. “You’re leaving the responsibility entirely to the individual, which makes sense from a privacy point of view,” says Reid. “But from a public health point of view, we’d be completely reliant on the individual calling us up, and it’s unlikely people will do that.”

Reid also notes that, with Bluetooth data alone, you’d have little idea about when or where contacts with an infected person might have occurred—whether the infected person was inside or outside, wearing a mask at the time, or behind a plexiglass barrier, all factors whose importance have become better understood since Google and Apple first announced their exposure-notification protocol.

All that helps explain why so many developers are turning to location data, even with all the privacy risks that location-tracking introduces. And that leaves users to sort through the privacy implications and potential health benefits of an app’s request for location data on their own—or to take the simpler path out of the minefield and just say no.

This story originally appeared on wired.com.

https://arstechnica.com/?p=1723206

Hackers sponsored by the Russian and North Korean governments have been targeting companies directly involved in researching vaccines and treatments for COVID-19, and in some cases, the attacks have succeeded, Microsoft said on Friday.

In all, there are seven prominent companies that have been targeted, Microsoft Corporate VP for Customer Security & Trust Tom Burt said. They include vaccine makers with COVID-19 vaccines in various clinical trial stages, a clinical research organization involved in trials, and a developer of a COVID-19 test. Also targeted were organizations with contracts with or investments from governmental agencies around the world for COVID-19-related work. The targets are located in the US, Canada, France, India, and South Korea.

“Microsoft is calling on the world’s leaders to affirm that international law protects health care facilities and to take action to enforce the law,” Burt wrote in a blog post. “We believe the law should be enforced not just when attacks originate from government agencies but also when they originate from criminal groups that governments enable to operate—or even facilitate—within their borders. This is criminal activity that cannot be tolerated.”

One of the attack groups involved is Strontium, Microsoft’s moniker for hackers sponsored by the Russian government. They are using password spraying and brute force login attacks that bombard servers with large numbers of credentials in the hopes of guessing correct ones. Last year, Microsoft caught Strontium infecting printers and other devices and using them as beachheads to compromise the networks they’re connected to. More recently, Microsoft said Strontium targeted the Trump and Biden campaigns.

Two other groups—dubbed Zinc and Cerium—work on behalf of North Korea’s government. Both are using spear phishing emails, with those from Zinc fabricating job recruiters and those from Cerium masquerading as representatives from the World Health Organization.

“The majority of these attacks were blocked by security protections built into our products,” Burt said of activities from all three groups. “We’ve notified all organizations targeted, and where attacks have been successful, we’ve offered help.”

Friday’s blog post comes two weeks after officials from three US governmental organizations warned that Russian ransomware hackers were targeting hundreds of US hospitals.

Other attacks, Burt said, have targeted hospitals in the Czech Republic, France, Spain, Thailand, and the US. In September, a patient died after a ransomware attack rerouted her to a remote hospital in Germany.

In April, Microsoft said it was making its AccountGuard threat notification service available to health care and human rights organizations working on COVID-19. So far, 195 organizations have enrolled. Microsoft now protects 1.7 million email accounts for health-care-related groups.

https://arstechnica.com/?p=1723323

The head of Donald Trump’s flagship vaccine project has called on the White House to allow Operation Warp Speed to make contact with Joe Biden’s transition team, warning that interrupting its work would put thousands of lives at risk.

Moncef Slaoui, a veteran pharmaceuticals executive who was appointed by Mr. Trump to accelerate the hunt for a vaccine, told the Financial Times he wanted to make sure his project continued operating without impediment during the transfer of power.

The comments from Mr. Slaoui, whose project is overseeing the development of five potential vaccines, come as the president faces pressure to concede defeat and allow a transition to the Biden administration to begin.

Mr. Slaoui said: “I hope nothing interferes with [Operation Warp Speed]. It is a matter of life and death for thousands of people. The operation has always been about making vaccines and therapeutics available faster for the country and for the world.”

Asked whether that meant allowing the project to make contact with Mr. Biden’s team, he replied: “I would assume, yes.”

However, Mr. Moncef noted that he could not reach out to the Biden team without a green light from the White House. “It’s not for us to decide, frankly,” he said.

He added: “We’re focused on our objective and we continue the objective. We will deliver the objective, whichever administration asks us to deliver it.”

So far Mr. Trump has refused to allow the General Services Administration to recognize Mr. Biden’s victory in last week’s election—a prerequisite for a formal transition to begin—as the president’s lawyers continue to wage legal battles in swing states around the country.

Pressure is building on Mr. Trump to back down, however, with former national security officials and Republican senators saying this week they want Mr. Biden to receive high-level intelligence briefings.

Mr. Moncef’s intervention comes as the virus continues to spread rampantly in the US, which logged a record 150,526 new cases on Thursday as hospitalizations and deaths continue to climb.

Mr. Trump has been criticized for not doing enough to tackle the pandemic, especially since losing the election last week. He has not met his coronavirus task force for weeks despite the rapid spread of the virus, although on Friday the president announced an afternoon press conference to discuss Operation Warp Speed.

Mr. Slaoui said Mr. Trump had been a supportive leader, adding the president had “fully met” his demand that the project’s work be free of political interference.

And the vaccine tsar, who spent decades at pharma company GSK, hinted that he would stand down soon, adding that he sees his personal role in the “transient mission” drawing to a close now that Pfizer’s vaccine is on the cusp of approval with high hopes for a second from Moderna.

“I would feel that I have achieved most of what I was hoping to achieve, with two vaccines approved . . . and the other vaccines in phase 3 trials,” he said.

Moderna could have its potential Covid-19 vaccine approved at the same time as Pfizer if they produce similar results, Mr. Slaoui said.

Pfizer, with its German partner BioNTech, and Moderna are developing vaccines using a similar technology known as messengerRNA. Moderna said on Wednesday that it had met its target for an interim analysis and is sending the data to an independent data monitoring board for review.

Pfizer became the first vaccine from Operation Warp Speed to unveil its phase 3 clinical trial data earlier in the week, surprising experts with a high efficacy rate of 90 per cent.

Mr. Slaoui said he was “super excited” to the point of speechlessness when Albert Bourla, Pfizer’s chief executive, called him to discuss the results on Monday morning.

Pfizer is the only vaccine manufacturer in Operation Warp Speed that has not taken direct investment from the US government, although it did secure a $1.95bn order that will be fulfilled if the inoculation is approved. Other large pharmaceutical companies including Johnson & Johnson and AstraZeneca have taken direct money to help fund development.

Mr. Slaoui said Pfizer did not need financial support but stressed that Operation Warp Speed had helped it with logistical stumbling blocks such as securing raw materials and equipment and planning the ultra-cold distribution network that will be needed to deliver the heat-sensitive vaccine.

© 2020 The Financial Times Ltd. All rights reserved Not to be redistributed, copied, or modified in any way.

https://arstechnica.com/?p=1723311

The number of broadband “power users”—people who use 1TB or more per month—has doubled over the past year, ensuring that ISPs will be able to make more money from data caps.

In Q3 2020, 8.8 percent of broadband subscribers used at least 1TB per month, up from 4.2 percent in Q3 2019, according to a study released yesterday by OpenVault. OpenVault is a vendor that sells a data-usage tracking platform to cable, fiber, and wireless ISPs and has 150 operators as customers worldwide. The 8.8- and 4.2-percent figures refer to US customers only, an OpenVault spokesperson told Ars.

More customers exceeding their data caps will result in more overage charges paid to ISPs that impose monthly data caps. Higher usage can also boost ISP revenue because people using more data tend to subscribe to higher-speed packages.

“As traffic has exploded during the pandemic, data aggregated from our network management tools confirms the value of usage-based billing in prompting subscribers to self-align their speed plans with their consumption,” OpenVault CEO Mark Trudeau said in a press release. This helps ISPs boost their average revenue per user, he said.

For example, ISPs that impose data caps had 25-percent more gigabit-speed subscribers than ISPs that don’t impose data caps, possibly because ISPs that impose caps “often provide higher usage quotas for the gigabit tier than the slower bandwidth tiers,” OpenVault said. “This provides incentive to subscribers of UBB [usage-based billing] operators to upgrade to the faster speeds.” Overall, 5.6 percent of subscribers in OpenVault’s dataset paid for gigabit speeds, up from 2.5 percent a year ago.

Temporary break from data caps

Customers of Comcast and other ISPs got a break from data caps for a few months this year when operators pledged to suspend the limits during the pandemic. But Comcast reinstated its data cap for cable customers on July 1, and AT&T reinstated data caps on DSL and fixed-wireless customers. Currently, AT&T is scheduled to reimpose data caps on fiber-to-the-home and fiber-to-the-node customers on January 1.

Comcast did raise its monthly cap from 1TB to 1.2TB on July 1, so not all terabyte users have to pay overage charges. Comcast also lowered the price of unlimited data from $50 to $30 a month, or $25 for customers who lease an xFi Gateway. Without the unlimited-data upgrade, Comcast overage charges are $10 for each additional block of 50GB.

AT&T imposes monthly data caps of 150GB on DSL, 250GB on fixed wireless, and 1TB on its faster wireline services.

US broadband networks have performed pretty well during the pandemic, at least outside of areas where modern broadband simply isn’t available, demonstrating again that data caps are a business decision rather than a necessity for network management.

2TB users also on the rise

The number of “extreme power users,” those who use at least 2TB per month, was up to about 1 percent of broadband customers in OpenVault’s Q3 2020 data. That’s nearly a three-fold increase since Q3 2019 when it was 0.36 percent.

OpenVault said the average US broadband household uses 384GB a month, up from 275GB a year ago. The median figures were 229GB, up from 174GB a year ago. Usage increases happen every year, but OpenVault said this year’s boost was fueled partly by the pandemic.

“While bandwidth usage is remaining relatively flat quarter over quarter, it is not retreating to pre-pandemic levels, indicating that COVID-19-driven usage growth has established a new normal pattern for bandwidth usage,” OpenVault said. European usage also went up during the pandemic but remained below US levels, with an average of 225GB and median of 156GB in Q3 2020.

The number of customers who have to pay overage charges may be limited somewhat by people intentionally restricting data usage to avoid the cap. Among US customers with unlimited data plans, 9.4 percent exceeded 1TB and 1.2 percent exceeded 2TB, OpenVault said in yesterday’s report. For customers with data caps, 8.3 percent exceeded 1TB and 0.9 percent exceeded 2TB.

In potentially bad news for customers, OpenVault seems to be urging ISPs that haven’t imposed data caps to adopt them. “The goal for network operators is to ensure that subscribers who consume the most bandwidth are in faster, higher ARPU [average revenue per user] speed tiers,” OpenVault said. “Usage-based billing operators are achieving this goal more, on average, than network operators who utilize flat-rate unlimited billing.”

https://arstechnica.com/?p=1723177

Elon Musk has tested positive for the coronavirus, he announced on Twitter. He also tested negative.

“Was tested for covid four times today,” Musk wrote on Thursday evening. “Two tests came back negative, two came back positive.”

Musk believes that “something extremely bogus is going on.”

But a mix of positive and negative results isn’t that surprising. Musk took a rapid antigen test from the medical technology company BD. According to the FDA, “positive results are usually highly accurate” with antigen tests, while false negatives are more common. So it wouldn’t be unusual for a patient with COVID-19 to get both negative and positive results.

Musk says he has also ordered a PCR test. This type of test is more accurate, but it will take about 24 hours to get the result.

Musk says he has “symptoms of a typical cold. Nothing unusual so far.”

Musk has opposed COVID restrictions

Musk has long argued that public health officials were exaggerating the risks of the coronavirus. In March, he predicted that the US would have “close to zero new cases” by the end of April. That proved way too optimistic.

When county officials ordered Tesla to shut down its factory in Fremont, California, in March, Musk resisted. Tesla finally shut down the facility several days after the order took effect. In May, he sued for the right to quickly resume operations.

In an April earnings call, he described lockdown requirements as “fascist,” calling on officials to “give people back their goddamn freedom.”

Musk’s positive results come at a time when the United States is suffering its third and largest surge in coronavirus cases. On Thursday, the number of new positive COVID-19 test results in the United States topped 160,000 for the first time.

https://arstechnica.com/?p=1723143

The chief executive of Google’s parent company Alphabet has apologized to Thierry Breton after an internal document laid out a plan to attack the EU commissioner and promised that such tactics were “not the way we operate.”

In a virtual meeting on Thursday, Sundar Pichai told Mr. Breton, the internal market commissioner, that Google was a very large company and that the document “was never shown to me.” He added that he had not “sanctioned” the plan, according to two people familiar with the conversation.

The document set out Google’s response to landmark new legislation from the EU as the bloc reshapes how it regulates Internet companies.

It contained a two-month strategy to remove “unreasonable constraints” to Google’s business model and “reset the narrative.” It singled out Mr. Breton, listing one objective to “increase pushback” on the French commissioner in an attempt to weaken support for the proposed plans in Brussels.

Mr. Breton, who is leading the overhaul of digital rules in the bloc, told Mr. Pichai that the EU had listened to Google’s feedback to public consultations on the new regulations.

“I want to hear and listen to everybody. You sent us two documents. I read them carefully,” Mr. Breton said.

Referring to the leaked document, he said: “This is an old-century matter: pushing back a regulator, saying that we need to mobilise the US government, saying that [the new rules] could destroy the transatlantic alliance… not really.”

Mr. Pichai said he also became aware of it when it became public in the media. He said: “I am sorry it happened that way.” But he said he took full responsibility for the leak and added: “This is not Google.”

Mr. Pichai assured the commissioner that he would engage directly with him, adding that he understood there was a need for balanced regulation, saying that the company would be “direct and transparent.”

The revelations came at a particularly tense moment as EU regulators are expected to come up with draft proposals in weeks.

The draft legislation will mark two significant changes. First, Brussels will set out more responsibilities for large platforms over how they should police illegal content and counterfeit goods in the Digital Services Act.

Secondly, the EU will come up with new criteria on what constitutes a gatekeeper and will draw up a list of what is expected of big Internet platforms, a move that is likely to result in tougher rules for companies such as Google and Facebook.

Google said Mr. Pichai and Mr. Breton “had a frank, but open conversation about plans to update digital policy in Europe.”

It added: “Our online tools have been a lifeline to many people and businesses through lockdown, and Google is committed to continuing to innovate and build services that can contribute to Europe’s economic recovery post Covid.”

© 2020 The Financial Times Ltd. All rights reserved. Not to be redistributed, copied, or modified in any way.

https://arstechnica.com/?p=1723110