We now have less than two weeks to go before the federal voting deadline for the presidential election on November 3, and basically everything is, as many expected, hitting the fan at once. Now, intelligence officials and lawmakers are all but begging Americans to be less credulous with what they see and hear online amid new allegations that actors from Iran emailed individual voter-intimidation efforts.

Director of National Intelligence John Ratcliffe and FBI Director Christopher Wray joined forces at a hastily announced press conference Wednesday night to issue a warning that foreign actors “have taken specific actions to influence public opinion relating to our elections.” Specifically, Ratcliffe said, actors from Iran and Russia had separately obtained “some voter registration information” and were using it “to communicate false information to registered voters that they hope will cause confusion, sow chaos, and undermine your confidence in American democracy.”

Ratcliffe was referring to an email campaign that started earlier this week, when some voters in Florida, Arizona, and Alaska started receiving threatening messages.

“Vote for Trump… or we will come after you,” the emails read. “Change your party affiliation to Republican to let us know you received our message and will comply. We will know which candidate you voted for. I would take this seriously if I were you. Good luck.”

Mystery messages

The emails purported to come from the Proud Boys, a known US-based right-wing extremist group that has become increasingly active since its founding in 2016 and which President Donald Trump has tacitly supported. The Proud Boys reportedly denied involvement, however, and Vice Motherboard reported on Tuesday that the messages originated from a server in Estonia and were likely using a spoofed email address.

Some voters also received videos, with Proud Boys branding, that showed how someone could allegedly commit voter fraud using the recipient’s personal information. Motherboard today published a redacted, labeled copy of the video to demonstrate what a disinformation campaign can look like.

Ratcliffe on Wednesday said that Iran was behind the spoofed emails and videos, which he claimed were “designed to intimidate voters, incite social unrest, and damage President Trump.”

“We’re not going to tolerate foreign interference in our elections or any criminal activity that threatens the sanctity of your vote or undermines public confidence in the outcome of the election,” Wray added in the press conference.

Iran denied any involvement. “Unlike the US, Iran does not interfere in other country’s elections,” Alireza Miryousefi, a spokesman for the Iranian Mission to the United Nations, told NBC News late Wednesday. “The world has been witnessing US’ own desperate public attempts to question the outcome of its own elections at the highest level. These accusations are nothing more than another scenario to undermine voter confidence in the security of the US election and are absurd.”

Chaos-causing data easy to get

Neither Wray nor Ratcliffe provided evidence explaining why intelligence officials believe Iranian actors to be the source of the emails. However, some independent researchers as well as other government officials are supporting the claim.

Sens. Marco Rubio (R-Fla.) and Mark Warner (D-Va.), respectively the chairman and vice chairman of the Senate Intelligence Committee, released a joint statement today confirming Iran’s involvement.

“It is clear that Iran is now actively seeking to sow dissent and divide us, much like Russia did in 2016 and continues to do today,” the senators said. “To the American people and the media, we reiterate the need to be skeptical of sensationalist, last-minute claims about election infrastructure. State, local, and federal officials, and partners in social media and tech, should be proud of joint efforts to shut down Iranian and Russian efforts.”

“Undermine the winner’s legitimacy”

“Above all, Russia and Iran want the losing side to reject the election outcome in order to undermine the winner’s legitimacy and spark a constitutional crisis,” Rubio added in a tweet last night. “Staging fake voter intimidation and sensationalist last-minute claims of widespread election fraud lays the groundwork for this.”

Senate Minority Leader Chuck Schumer (D-N.Y.) said in an interview Wednesday night after the press conference that “it was clear to me that the intent of Iran in this case, and Russia in many more cases, is to basically undermine confidence in our elections.”

Although Ratcliffe mentioned both Iran and Russia, his remarks focused primarily on Iran. Nonetheless, according to The Washington Post, US officials speaking privately also stressed that Russia remains a concern.

It’s not a particular hardship for either nation—or in fact, anyone else— to access the voter registration data that the entity behind the emails apparently used. Such lists are generally a matter of public record, and campaigns, advocacy groups, and other organizations acquire them legally all the time.

Please be smart

Above all, the FBI, DNI, Senate, and just about everyone else involved share one common message to Americans: please, please don’t be gullible in this high-tension, disinformation-rich environment.

“You should be confident that your vote counts,” Wray said in his remarks. “Early, unverified claims to the contrary should be viewed with a healthy dose of skepticism. We encourage everyone to seek election and voting information from reliable sources—namely, your state election officials. And to be thoughtful, careful, and discerning consumers of information online.”

Rubio and Warner, in a statement released last night, echoed the feeling. “As we enter the last weeks before the election, we urge every American—including members of the media—to be cautious about believing or spreading unverified, sensational claims related to votes and voting,” the senators said.

Streaming platform Twitch this week surprised many of its users when it sent out a huge batch of copyright takedown emails. These messages not only didn’t tell streamers what supposedly infringing content they posted, but it also said that Twitch had simply deleted content outright without giving users a chance to appeal.

Many Twitch “partners”—the folks who make actual money from their Twitch participation—received emails on Tuesday warning that some of their archival content was about to be deleted for violating copyright law.

“We are writing to inform you that your channel was subject to one or more of these DMCA takedown notifications and that the content identified has been deleted,” a screenshot of the email posted to Twitter by streamer Devin Nash reads. The email then goes on to recommend that users familiarize themselves with Twitch’s guide to copyright law before “normal processing” of DMCA notifications resumes on Friday (October 23).

Unsafe harbor

The Digital Millennium Copyright Act (DMCA), which has governed online copyright matters in the United States since 1998, has what’s known as a safe harbor provision in it. Sites that host content, such as Twitch, can’t be sued for hosting infringing materials if they respond quickly to notices from copyright holders informing them of the violation—thus, the takedown notice. A content owner, or a bot like YouTube’s Content ID system, flags content, and the platform then removes it as quickly as possible, notifying the person who shared it.

However, under the DMCA, users are also supposed to be able to appeal those rulings with a counter-notification, and Twitch does indeed have a counterclaim process. In order to file a counter-notification, affected users have to submit a written notice that includes, among other things, an identification of what material was removed or had access disabled, with a link; full name, address, and signature; and a statement, sworn under penalty of perjury, that the material “was removed or disabled as a result of mistake or misidentification.”

This time around, though, users aren’t getting that option. Twitch not only didn’t actually tell users what infringing content was connected to their account—it just went ahead and deleted everything permanently anyway, according to the emails:

We recognize that by deleting this content, we are not giving you the option to file a counter-notification or seek a retraction from the rights holder. In consideration of this, we have processed these notifications and are issuing you a one-time warning to give you the chance to learn about copyright law and the tools available to manage the content on your channel.

Why?

The deletions and notifications are apparently related to a “sudden influx of DMCA takedown requests for clips with background music from 2017-19” that Twitch said in June it had received. Those, in turn, apparently stemmed from a sudden increase in action by the RIAA at the time. According to an August CNN report, the RIAA sent more than 1,800 copyright infringement notices to Twitch in June alone, whereas it had previously sent only about 700 total across the previous three years.

Part of keeping your safe harbor liability protection is dealing with notices as quickly as possible. Sitting on a massive pile of notifications, to deal with one at a time over the course of months, doesn’t really qualify as “quick” by any measure, so Twitch found a way to act in bulk. A representative for Twitch confirmed to Kotaku that the company went for a mass action because it was dealing with “thousands” of backlogged infringement notifications from the holders of music rights.

Once Twitch is caught up, it plans to handle future infringements on a “normal” basis. In June, the company said it was expanding its use of automated technology to scan archived clips for copyrighted music and added that it would automatically delete clips it found to be violating copyright, rather than penalizing streamers for them. The company reiterated that position yesterday, and that procedure goes into effect on Friday.

Just delete everything!

In the meantime, however, Twitch’s advice to streamers is unhelpful, to say the least. Not only do users have no way to know which of their clips were flagged, but Twitch’s best advice seems to be “delete everything.”

“To avoid receiving a DMCA takedown notification for the recorded content that remains on your channel, we recommend you take the following actions,” Twitch wrote in the emails. “Review your Clips, VODs, and any other content in your Creator Dashboard and delete anything that includes unlicensed copyrighted material. If you are unsure about the contents of your archive, you can delete all of it.”

Twitch did not provide users with a tool to mass-delete or mass-archive their content, although Justin Ignacio, one of Twitch’s founders (who left the company in 2018) shared a third-party tool for doing so on Twitter.

Streamers, as you might expect, have a huge problem with Twitch’s low-communication approach. “It is INSANE that Twitch informs partners they deleted their content—and that there is more content in violation despite having NO identification system to find out what it is,” Nash wrote in the tweet where he shared the email. “Their solution to DMCA is for creators to delete their life’s work. This is pure, gross negligence.”

“Tell me!”

Another full-time streamer, who goes by Lowco, aptly summarized the problem in a video.

“See, here’s the problem,” she said. “They’re not telling you what or when this DMCA takes place or what it’s for, and they’re not giving you an option to counterclaim. So the fact that they’re not even giving you the option to review it—this is inappropriate… They’re giving you one warning? For what? What are you warning me for? Tell me!”

Lowco added, “‘Oh, by the way, we have no tools, so good luck reviewing ten thousand videos, and if you don’t do it by tomorrow, we’re going to ban you.’ … This kind of pisses me off. I’m worried.”

Twitch, for its part, said, “We are incredibly proud of the essential service Twitch has become for so many artists and songwriters, especially during this challenging time. It is crucial that we protect the rights of songwriters, artists, and other music industry partners. We continue to develop tools and resources to further educate our creators and empower them with more control over their content while partnering with industry-recognized vendors in the copyright space to help us achieve these goals.”

The Federal Communications Commission’s top lawyer today explained the FCC’s theory of why it can grant President Donald Trump’s request for a new interpretation of a law that provides legal protection to social media platforms like Twitter and Facebook.

Critics of FCC Chairman Ajit Pai’s plan from both the left and right say the FCC has no authority to reinterpret Section 230 of the Communications Decency Act, which gives legal immunity to online platforms that block or modify content posted by users. FCC General Counsel Thomas Johnson said those critics are wrong in a blog post published on the FCC website today.

Johnson noted that the Communications Decency Act was passed by Congress as part of the Telecommunications Act of 1996, which was an update to the Communications Act of 1934 that established the FCC and provided it with regulatory authority. Johnson also pointed to Section 201(b) of the Communications Act, which gave the FCC power to “prescribe such rules and regulations as may be necessary in the public interest to carry out the provisions of this Act.”

Johnson then explained why he believes this means the FCC can reinterpret Section 230:

The Supreme Court has twice considered whether the FCC’s general rulemaking authority under Section 201(b), adopted in 1938, extends to the 1996 amendments to the Act. Both times, the Court held that it does. Writing for the Court in Iowa Utilities Board, and employing his trademark textualist method, Justice Scalia wrote that this provision “means what it says: The FCC has rulemaking authority to carry out the ‘provisions of [the 1934] Act.'” The Court explained that “the clear fact that the 1996 Act was adopted, not as a freestanding enactment, but as an amendment to, and hence part of, [the 1934] Act” shows that Congress intended the Commission to have rulemaking authority over all its provisions. Likewise, in the later City of Arlington case, the Court confirmed that the Commission’s rulemaking authority “[o]f course… extends to the subsequently added portions of the Act.” From these authorities, a simple conclusion follows: Because Section 230 is among the “subsequently added portions of the Act,” it is subject to the FCC’s Section 201(b) rulemaking authority.

FCC still wrong, critics say

One problem with citing Section 201—which is part of the Communications Act’s well-known Title II—is that the section applies to common carriers. The Pai FCC in 2017 justified its repeal of net neutrality rules by claiming that the commission has no authority to regulate broadband providers as common carriers under Title II—even though courts had specifically ruled the FCC does have such authority. Now, the FCC is citing Title II to claim some authority over social media platforms, which have not been classified as common carriers.

But John Bergmayer, legal director at consumer-advocacy group Public Knowledge, disagrees. Today he told Ars, “201 is concerned with common carriers, not information services. Of course the 1996 Amendments are part of the [Communications] Act. But 201(a) and (b) are both directly addressed to the duties of common carriers.”

Johnson argued in his blog post that “the general grant of rulemaking authority at the end of Section 201(b) contains no reference to common carriers; it simply empowers the Commission to make rules that are ‘necessary in the public interest to carry out the provisions of this Act,’ without qualification.”

However, common-carrier regulation is the topic of all of the text in the single-paragraph Section 201(b) leading up to the statement cited by Johnson. Here’s what the statute looks like on the FCC website:

Still, Johnson provided another citation to back the FCC’s case on the point. The US Court of Appeals for the 6th Circuit in 2008 “held that Section 201(b) gave the Commission authority to interpret ambiguous provisions in the Cable Television Consumer Protection and Competition Act of 1992,” Johnson wrote. “Notably, that Act by its terms applies to cable operators, not common carriers. The Court reasoned… that it was sufficient that the 1992 law amended the Communications Act and incorporated the relevant provisions therein. The same reasoning applies to Section 230.”

FCC claims law is ambiguous

Even if the FCC does have authority to interpret Section 230, Bergmayer argued that “there is nothing for the agency to do here. The statute is self-executing and interpreted by the courts, and the FCC’s ‘help’ has never been needed before.”

Section 230 says that providers and users of interactive computer services shall not be held liable for “any action voluntarily taken in good faith to restrict access to or availability of material that the provider or user considers to be obscene, lewd, lascivious, filthy, excessively violent, harassing, or otherwise objectionable, whether or not such material is constitutionally protected.”

Johnson argued in his blog post that “Section 230 contains ambiguous terms” such as “voluntarily taken in good faith” and “otherwise objectionable.” He added that the FCC “has the authority to clarify these ambiguities in Section 230.” But Public Knowledge wrote in comments to the FCC last month that the terms “otherwise objectionable” and “good faith” are not ambiguous in the context of the statute.

“‘Otherwise objectionable’ is a subjective term, not an ambiguous one,” Public Knowledge wrote. “The fact that one platform might find content objectionable, and others might not, does not mean that the FCC (or even federal courts) can substitute their own judgment for the editorial, content moderation decisions of platforms. In fact, different platforms having different views as to what is and is not ‘objectionable’ is exactly what is intended by Section 230, which seeks to foster ‘a true diversity of political discourse’ on the Internet as a whole across a multiplicity of forums… It is a fundamental error to confuse a subjective standard with an ‘ambiguous’ one.

“Good faith” in this context “is not an ambiguous technical term, either—it is a common law term of art that state and federal courts are accustomed to applying in a great variety of contexts,” Public Knowledge wrote. “Article 3 federal courts are not crying out to the FCC for help in determining what ‘good faith’ means in the context of litigation between private parties, which… is what Section 230 addresses.”

“There’s no ambiguity to resolve”

Johnson’s blog post likely won’t end any disputes over Pai’s plan. House Democrats this week accused Pai of turning the FCC into “a political appendage of President Trump’s campaign” by aiding Trump’s battle against social media websites.

Lawsuits against the FCC are likely if the commission finalizes a reinterpretation of Section 230. Matt Wood, VP of policy and general counsel at media-advocacy group Free Press, told Ars today:

The FCC lawyers’ latest sleight-of-hand is a clever distraction, but still not good enough to save the Commission’s pending foray into speech codes and Internet regulation. The agency claims that it’s not going to make rules, it’s merely going to interpret the supposed ambiguities in the language of Section 230 and let courts apply that interpretation. But there’s no ambiguity to resolve, nor any reason for courts to follow the FCC’s interpretation. And there’s no hiding the fact that the FCC’s pretense of interpretation without the effect of substantive rules is a ruse and nothing better.

Operators of Trickbot—a for-hire botnet that has infected more than 1 million devices since 2016—are looking for new ways to stay afloat after Microsoft and a host of industry partners took coordinated action to disrupt it last week.

In an update published on Tuesday, Microsoft Corporate VP for Security & Trust Tom Burt said the operation initially managed to take down 62 of the 69 servers Trickbot was known to be using to control its vast network of infected devices. Trickbot operators responded by quickly spinning up 59 new servers, and Microsoft was able to eliminate all of them except for one.

In all, the industrywide operation has taken down 120 of 128 servers identified as belonging to Trickbot. Now, Trickbot is responding by using a competing criminal group to distribute the Trickbot malware.

Fighting to stay alive

“This is one of many signs that suggests to us that, faced with its critical infrastructure under repeated attack, Trickbot operators are scrambling to find other ways to stay active,” Burt wrote. “While an arrangement with other actors will not enable Trickbot to equal its homegrown capabilities, it’s also a reminder that there are many threats to keeping cyberspace secure and it’s important for people—especially those involved in the security of our electoral processes—to stay vigilant.”

Burt, who has overseen several global botnet takedowns in the past, said the industry is getting better at them. After identifying new Trickbot servers, Microsoft and its partners have been able to locate their respective hosting providers, initiated required legal actions, and taken down the new infrastructure in as little as three hours. With the coordination of the many partners, one takedown took less than six minutes from the time the provider hosting the server was notified.

Burt also said that rebuilding an infrastructure of command servers is time-consuming and isn’t simply a matter of setting up new servers. “New servers need to be provisioned to begin talking with the botnet’s infected devices and issuing commands, all of which takes time.” He said that many of the servers that remain standing are routers or other types of Internet-of-things devices that aren’t vulnerable to normal takedown procedures.

People outside of Microsoft agreed that the takedown appears to be achieving results. Marcus Hutchins, a researcher who closely follows botnets, said that Trickbot has two classes of servers. Command servers update configurations and send commands, while plugin servers download modular tools used for things like bank fraud, infecting new computers, or sending spam.

Even a single command server can rapidly tell all infected computers where to find new control servers, so the partial takedown of them isn’t much of a body blow, Hutchins said. In fact, in the hours leading up to the publishing of this post, the botnet operators were able to add 13 new command servers.

Where things get more optimistic for the takedown members is that, for some reason, none of the plugin servers are being replaced.

“Without the plugin servers, the bot is just a loader with nothing to load,” Hutchins told me. “Essentially, the botnet is out of action for now. As long as they have working C2s, they could revive it. But as it stands, they have not.”

“I’m not dead yet”

Hutchins said that the victory is by no means complete. For one thing, it’s possible the plugin servers may still be restored. And for another, at the time this post was going live, the Trickbot operators were actively deploying ransomware using what’s called the BazarLoader.

It’s still too early to declare victory. It’s not clear precisely why the plugin servers aren’t being replaced. If the plugin servers return, Trickbot’s normal malicious tricks will likely return.

“It’s definitely not dead,” Hutchins said, “just incapacitated.”

The Justice Department today filed a landmark antitrust case against Google. The hotly anticipated, long-awaited lawsuit accuses Google of using its market dominance to force unfair contract terms on suppliers and competitors to the detriment of competition and the marketplace.

The suit might just be the biggest thing in antitrust since the DOJ sued Microsoft in the 1990s… or it might not. Even though the investigation that led here has been going on for 16 months, a suit like this is the beginning, not the end, of the process. So here’s everything we know—and more importantly, everything we still don’t—about what this blockbuster case really means.

What does the suit allege?

The complaint (PDF) lays out the case that Google used “exclusionary agreements and anticompetitive conduct” to become dominant in the search marketplace, and then kept abusing that market dominance to prevent nascent rivals from gaining enough of a toehold potentially to become real competition.

The suit is focused on Google’s search business, including search advertising and “general search text advertising,” which the DOJ alleges the company has “monopolized” for more than a decade.

“For years, Google has entered into exclusionary agreements, including tying arrangements, and engaged in anticompetitive conduct to lock up distribution channels and block rivals,” the DOJ writes in the suit. It goes on:

Google pays billions of dollars each year to distributors—including popular-device manufacturers such as Apple, LG, Motorola, and Samsung; major U.S. wireless carriers such as AT&T, T-Mobile, and Verizon; and browser developers such as Mozilla, Opera, and UCWeb—to secure default status for its general search engine and, in many cases, to specifically prohibit Google’s counterparties from dealing with Google’s competitors. Some of these agreements also require distributors to take a bundle of Google apps, including its search apps, and feature them on devices in prime positions where consumers are most likely to start their internet searches.

Although there are alternative search engines in the world, such as DuckDuckGo or Bing, the DOJ argues that Google’s scale and anticompetitive behaviors have at this point made its dominance insurmountable without intervention.

Google’s full response claims that the DOJ filed “a deeply flawed lawsuit that would do nothing to help consumers.” Consumers, however, aren’t the major target of the complaint. Competitors are. The complaint does not particularly address potential harms we, the end consumers, may experience as a result of this monopoly. Instead, it focuses on all the harms Google has allegedly done to other businesses in the digital supply chain.

Just search, though? That’s it, really?

That’s it, really. The DOJ’s lawsuit is pretty narrow at this time and mainly focuses on just one of Google’s sprawling business ventures. There are, however, plenty of other Google behaviors to complain about.

For example, a blockbuster report released earlier this month by a House Judiciary subcommittee found not only that Google was abusing its power in the search market but also that it was abusing its control over the digital advertising market. Google achieved its dominance through a series of acquisitions it lied about, the House alleged, and also through illegally tying other apps, products, and services into the Android platform. The House report also cited the intertwining of Chrome, Google Maps, and Gmail into each other and into other Google services as anticompetitive behavior.

Previous probes into Google’s behavior have also taken issue with a much wider array of anticompetitive behaviors. In 2013, the company reached a settlement with the Federal Trade Commission in which it agreed to “change its business practices” across several segments of its sprawling business to avoid being sued for antitrust violations.

Two years later, however, The Wall Street Journal obtained a 160-page internal FTC document from the investigation leading to that settlement. The document showed that the agency’s competition bureau found Google “used anticompetitive tactics and abused its monopoly power in ways that harmed Internet users and rivals.” Agency staff recommended taking stronger antitrust action against Google at the time, but the commissioners decided that asking Google to behave better, instead of going to litigation, would result in faster change and less harm to competition and consumers.

DOJ officials declined to tell press in a call if they plan to add additional allegations to the existing suit or even file additional suits down the line. But they did confirm several times that their investigations into Google and other major digital platforms are still ongoing, implying that there’s room for additional complaints if the DOJ decides the evidence merits it.

So is Google going to get broken up?

It’s definitely possible—but also definitely not at all guaranteed. DOJ officials did not say they were looking for a breakup, but they also didn’t rule it out. “Nothing is off the table” is all they would say.

The suit is very vague about what specific relief the government seeks. As a start, the DOJ asks the court to rule that Google broke the law and to order Google not to do anticompetitive things anymore. It then also asks the court to “enter structural relief as needed to cure any anticompetitive harm” as well as any relief “necessary and appropriate to restore competitive conditions in the markets affected by Google’s unlawful conduct.”

In general, “structural remedies” tend to imply divestments or breakups—you’re literally changing the structure of the company to fix the problem. (In contrast, “behavioral remedies” imply requirements for or against specific behavior, as often seen with merger conditions.) The case is likely to be extremely long and complicated, and by the end of it, the court may determine that, yes, Google needs to be broken up to restore competitive conditions… or it may not. At this point, guessing that outcome is Magic 8 Ball territory.

Federal Communications Commission Chairman Ajit Pai has turned the FCC into “a political appendage of President Trump’s campaign” by aiding Trump’s battle against social media websites, two House Democrats said yesterday.

“Chairman Pai’s decision to start a Section 230 rulemaking is a blatant attempt to help a flailing President Trump,” said Energy and Commerce Chairman Frank Pallone Jr. (D-N.J.) and Communications and Technology Subcommittee Chairman Mike Doyle (D-Penn.). “The timing and hurried nature of this decision makes clear it’s being done to influence social media companies’ behavior leading up to an election, and it is shocking to watch this supposedly independent regulatory agency jump at the opportunity to become a political appendage of President Trump’s campaign.”

On Thursday last week, Pai announced that he is backing President Trump’s proposal to limit legal protections for social media websites that block or modify content posted by users. Pai said he will propose a new interpretation of Section 230 of the Communications Decency Act, limiting the legal immunity websites like Facebook and Twitter are granted when they block or screen content. Trump claims the companies are biased against conservatives, and he wants to post on social media without the platforms adding fact checks or limiting the reach of posts that violate their rules.

Pallone and Doyle say that Pai shouldn’t help Trump in his battle against social media companies:

From the start, Republicans have used the Section 230 debate to threaten social media companies when they remove or flag disinformation and extremism on their platforms—all because of some baseless fantasy grievance that the Internet is biased against conservative views. Their approach translates into a defense of online extremism and foreign countries’ disinformation campaigns, which is a baffling and dangerous position for lawmakers to take.

Section 230 reform that creates a structure for healthier online ecosystems is needed and we are committed to seeing it done—but the FCC’s rush to push President Trump’s agenda weeks before Election Day should be seen for the reckless and politically motivated stunt that it is.

We contacted Chairman Pai’s office about the Pallone/Doyle statement today and will update this article if we get a response.

Trump stacking the FCC

The FCC is supposed to act independently from the White House, but its members are nominated by the president. Trump is trying to stack the commission by replacing Republican FCC Commissioner Michael O’Rielly with Nathan Simington, an administration official who shares Trump’s views on Section 230. Simington’s nomination is pending Senate approval.

O’Rielly angered Trump by saying that the FCC must uphold First Amendment speech protections “that apply to corporate entities, especially when they engage in editorial decision making.” Similarly, critics of the Trump/Pai plan from both the left and right say the FCC has no authority to reinterpret Section 230 and that the plan would violate the First Amendment.

Pai hasn’t made any criticism of Trump for influencing the FCC’s rule-making process, despite having vehemently opposed the Obama White House’s milder attempts to influence the FCC’s net neutrality decision in 2015.

Six men accused of carrying out some of the world’s most destructive hacks—including the NotPetya disk wiper and power grid attacks that knocked out electricity for hundreds of thousands of Ukrainians—have been indicted in US federal court.

The indictment said that all six men are officers in a brazen hacker group best known as Sandworm, which works on behalf of Unit 74455 of the Russian Main Intelligence Directorate, abbreviated from Russian as GRU. The officers are behind the “most disruptive and destructive series of computer attacks ever attributed to a single group,” prosecutors said. The alleged goal: to destabilize foreign nations, interfere with their internal politics, and cause monetary losses.

Among the hacks is NotPetya, the 2017 disk-wiping worm that shut down the operations of thousands of companies and government agencies around the world. Disguised as ransomware, NotPetya was in fact malware that permanently destroyed petabytes of data. The result, among other things, was hospitals that turned away patients, shipping companies that were paralyzed for days or weeks, and transportation infrastructure that failed to function.

Those hit by the attack included hospitals and other medical facilities in the Heritage Valley Health System (“Heritage Valley”) in Pennsylvania; a FedEx Corporation subsidiary, TNT Express BV; and a large US pharmaceutical manufacturer, which together suffered nearly $1 billion in losses from the attacks. US intelligence long ago determined the GRU was behind the attack, but Monday is the first time charges have been filed in connection with it.

Other hacks called out in the indictments included:

• Ukrainian Government & Critical Infrastructure: December 2015 through December 2016 destructive malware attacks against Ukraine’s electric power grid, Ministry of Finance, and State Treasury Service, using malware known as BlackEnergy, Industroyer, and KillDisk
• French Elections: April and May 2017 spear-phishing campaigns and related hack-and-leak efforts targeting French President Emmanuel Macron’s “La République En Marche!” (“En Marche!”) political party, French politicians, and local French governments prior to the 2017 French elections
• PyeongChang Winter Olympics Hosts, Participants, Partners, and Attendees: December 2017 through February 2018 spear-phishing campaigns and malicious mobile applications targeting South Korean citizens and officials, Olympic athletes, partners, and visitors, and International Olympic Committee (“IOC”) officials
• PyeongChang Winter Olympics IT Systems (Olympic Destroyer): December 2017 through February 2018 intrusions into computers supporting the 2018 PyeongChang Winter Olympic Games, which culminated in the February 9, 2018 destructive malware attack against the opening ceremony, using malware known as Olympic Destroyer
• Novichok Poisoning Investigations: April 2018 spear-phishing campaigns targeting investigations by the Organisation for the Prohibition of Chemical Weapons (“OPCW”) and the United Kingdom’s Defence Science and Technology Laboratory’s (“DSTL”) into the nerve agent poisoning of Sergei Skripal, his daughter, and several UK citizens
• Georgian Companies and Government Entities: a 2018 spear-phishing campaign targeting a major media company, 2019 efforts to compromise the network of Parliament, and a wide-ranging website defacement campaign in 2019

Defendants named in the indictment included:

All six men are each charged with seven counts of conspiracy to conduct computer fraud and abuse, conspiracy to commit wire fraud, wire fraud, damaging protected computers, and aggravated identity theft.

“The object of the conspiracy was to deploy destructive malware and take other disruptive actions, for the strategic benefit of Russia, through unauthorized access (‘hacking’) of victim computers,” prosecutors wrote in the indictment. “In furtherance of the conspiracy, Andrienko, Detistov, Frolov, Kovalev, Ochichenko, Pliskin, and others known and unknown to the grand jury procured, maintained, and utilized servers, email accounts, malicious mobile applications, and related hacking infrastructure to engage in spearphishing campaigns and other network intrusion methods against computers used by the victims.”

The prosecutors also said that four of the men developed and deployed destructive malware used around the world.

The indictment is here, and a press release is here.

Twitter has changed its policy on sharing hacked materials after facing criticism of its decision to block users from tweeting links to a New York Post article that contained Hunter Biden emails allegedly retrieved from a computer left at a repair shop.

On Wednesday, Twitter said it blocked links to the Post story because it included private information and violated Twitter’s hacked materials policy, which prohibits sharing links to or images of hacked content. But on late Thursday night, Twitter legal executive Vijaya Gadde wrote in a thread that the company has “decided to make changes to the [hacked materials] policy and how we enforce it” after receiving “significant feedback.”

Twitter enacted the policy in 2018 “to discourage and mitigate harms associated with hacks and unauthorized exposure of private information,” Gadde wrote. “We tried to find the right balance between people’s privacy and the right of free expression, but we can do better.” Twitter will thus change its hacked materials policy to “no longer remove hacked content unless it is directly shared by hackers or those acting in concert with them.” Twitter will also “label Tweets to provide context instead of blocking links from being shared on Twitter.”

Twitter spokesperson Brandon Borrman wrote that the Post article is still blocked because “the materials in the article still violate our rules on sharing personal private information.” However, I was able to tweet a link to the Post story today and the block appears to be lifted.

Twitter CEO: “Straight blocking of URLs was wrong”

Twitter CEO Jack Dorsey acknowledged that Twitter handled the Post situation poorly, writing on Wednesday that “blocking URL sharing via tweet or DM with zero context as to why we’re blocking [was] unacceptable.” Today, Dorsey commented on the policy change, writing that “Straight blocking of URLs was wrong, and we updated our policy and enforcement to fix. Our goal is to attempt to add context, and now we have capabilities to do that.”

The Post’s headline on the story in question is, “Smoking-gun email reveals how Hunter Biden introduced Ukrainian businessman to VP dad.” But as the Poynter Institute’s PolitiFact noted, the emails cited in the Post article “do not establish that such a meeting ever occurred.”

While Twitter blocked links to the story outright, Facebook instead reduced its distribution.

New tools, new rules

Gadde noted that Twitter is “no longer limited to Tweet removal as an enforcement action” because of recently added features “such as labels to provide people with additional context.”

“We believe that labeling Tweets and empowering people to assess content for themselves better serves the public interest and public conversation,” she wrote. “The Hacked Material Policy is being updated to reflect these new enforcement capabilities.”

Other rules that could apply to the same types of tweets aren’t changing. “All the other Twitter Rules will still apply to the posting of or linking to hacked materials, such as our rules against posting private information, synthetic and manipulated media, and non-consensual nudity,” Gadde wrote.

The new policy is not yet in place but will be implemented “in the coming days,” Borrman wrote. Borrman also wrote that the policy was not “meant to chill journalistic efforts or whistleblowers.” But after Twitter’s decision to block the Post article, “very valid concerns were raised about the possible impact on some of the most important uses of Twitter,” he wrote.

Twitter and Facebook moderation is under scrutiny by the Trump administration, with Federal Communications Commission Chairman Ajit Pai moving ahead with Trump’s request to limit the legal protections that social-media websites have for decisions to block or modify content. The Senate Judiciary Committee reportedly plans to issue a subpoena to Dorsey over the Post article-blocking.