TikTok will be gone from app stores tomorrow morning unless a federal judge acts to block the Trump administration’s ban on the app before midnight tonight.

Judge Carl Nichols of the US District Court for DC said today that he will determine whether to grant or reject TikTok’s request for an injunction on the ban before the deadline hits at the stroke of 12.

In a hearing on Thursday, Nichols gave the administration until Friday afternoon either to delay or defend the ban. The administration chose to file a response defending the ban but did so under seal, so the filings are not available to the public.

The judge set a hearing on the matter for 9:30 today. After spending more than 90 minutes Sunday morning listening to attorneys for both sides, Nichols said he would rule later in the day.

During the hearing, an attorney representing TikTok called the proposed ban “irrational” and “unprecedented,” asking, “How does it make sense to impose this app store ban tonight when there are negotiations underway that might make it unnecessary?”

President Donald Trump banned TikTok and another China-based app, WeChat, in a pair of executive orders he signed on August 6. The executive orders declared the apps to be a “national emergency” and said that certain “transactions” would be prohibited, but the orders did not specify what those transactions might be until September 18, about 48 hours before the bans were first scheduled to take effect.

TikTok filed its request for an injunction (PDF) a few hours after the Commerce Department described what form the ban would take. Last weekend, the administration granted a one-week reprieve on the ban, extending the deadline to midnight (EDT) tonight, after the president gave his conditional “blessing” to a proposed deal between TikTok and Oracle.

The proposed ban would become unnecessary if China, the US Department of the Treasury, and the White House all agree to approve Oracle’s proposed investment in TikTok. Oracle is not offering to buy TikTok in that deal, but instead would take over cloud hosting services as TikTok’s “trusted technology partner” and take a 12.5-percent stake in a newly formed spinoff company, TikTok Global.

The fate of that transaction, however, is very much unknown. Oracle and ByteDance don’t seem to agree on who will hold majority control of the new company after the proposed deal is complete. Trump has threatened to withdraw his approval if he does not find that US, rather than Chinese, investors end up with sufficient control of TikTok. Editorials in several Chinese state-run media outlets over the past week have also expressed opposition to the transaction, calling it a “dirty and underhanded trick.”

https://arstechnica.com/?p=1710011

The FBI is intensifying its worldwide search for Michael James Pratt, the New Zealand-born pornographer who created the controversial GirlsDoPorn website while living in the San Diego area. This week the FBI announced a $10,000 reward for information leading to his arrest.

Nearly two dozen women sued Pratt and his associates for using fraud and coercion to get them to appear in pornographic videos. The women won a $13 million judgment in January, but by the time the ruling was announced, Pratt had apparently fled the country.

Meanwhile, the federal government charged Pratt with conspiracy to commit sex trafficking by force, fraud, and coercion. Prosecutors later added child pornography charges because at least one of his victims was under 18.

Pratt lured his victims by posting ads for clothed modeling gigs on Craigslist and other platforms. Once a woman responded, Pratt or one of his associates would offer the women $3,000 to $5,000 to fly to San Diego for a one-day pornography shoot. They promised, falsely, that videos would only be sold on DVD to wealthy clients outside the United States.

Some of the women said that once they reached San Diego, they were physically coerced to stay and shoot their scenes. Here’s how we described it back in January:

Women were picked up at the airport by a GirlsDoPorn staffer and chaperoned throughout their visit. During shooting, they were alone with two or more men they didn’t know. The men would become agitated if the women didn’t cooperate; some women testified that they feared for their safety. Women testified that men stacked equipment in front of the door to prevent them from leaving the room.

Three of Pratt’s associates, Matthew Wolfe, Andre Garcia, and Valerie Moser, were charged with conspiracy to commit sex trafficking last October along with Pratt. Only Pratt has evaded capture.

https://arstechnica.com/?p=1709802

Alphabet, Google’s parent company, said today it has settled a set of shareholder lawsuits related to the company’s handling of sexual harassment claims. Alphabet will commit $310 million to corporate diversity programs over the next decade, and the company agreed to allow its board to take on a greater oversight role in misconduct cases.

As part of the new agreement, Alphabet will expand on its current policy of “prohibiting severance for anyone terminated for any form of misconduct,” to include anyone who is currently under investigation for “sexual misconduct or retaliation,” Google VP of People Operations Eileen Naughton said in a company blog post.

The settlement is the outcome of a consolidated set of lawsuits investor groups filed against Alphabet in California in 2018, alleging that the company breached its fiduciary duty to shareholders when it retained, and handsomely paid off, male executives credibly accused of sexual harassment. (Other shareholder suits, in federal court and in Delaware, are still in progress, according to the New York Times.)

The lawsuits followed reports finding that three top Google executives who left the company amid allegations of misconduct got to leave quietly with massive compensation packages. Android creator Andy Rubin was given a $150 million stock grant, as well as a $90 million severance package, when he was ushered out of the company in 2014 after Google determined a sexual misconduct complaint against him was credible.

Thousands of Google employees staged a walkout in 2018 in protest over the way the company handled the cases of Rubin and others. Protest organizers demanded more transparency from Google over reports of harassment and pay inequity, as well as a new process for safely and anonymously reporting misconduct and an end to forced arbitration.

As part of the settlement, arbitration will now be optional, rather than mandatory, not only for full-time Alphabet employees but also for “temporary staff, vendors, and independent contractors” who have harassment, discrimination, or retaliation disputes with Alphabet—an expansion of its 2018 pledge not to require arbitration in sexual harassment cases. Employees will also not be required to agree to nondisclosure agreements to settle claims of sexual harassment or retaliation.

Alphabet also promised to “enhance investigations processes,” including “how we escalate concerns, how quickly we respond, how we reopen cases, and more.” Complaints involving company senior leadership will also have a “specialist team” assigned, which will report its results to the board of directors.

Google will also officially prohibit personal relationships (“romantic, physical, familial”) in direct reporting or management chains, instead of just “strongly discouraging” them, which was apparently company policy until this point.

“Together, [CEO] Sundar [Pichai], the [Diversity, Equity, and Inclusion] Advisory Council, and the Board will uphold Alphabet’s unwavering commitment to prohibit and respond effectively to complaints of sexual harassment, discrimination, and retaliation and promote diversity, equity, and inclusion in the workplace,” Naughton said. “’m grateful to everyone, especially our employees and shareholders, for providing us with feedback, and for making sure that the way we tackle these vital issues is better today than it was in the past.”

https://arstechnica.com/?p=1709728

Facebook has temporarily shamed Apple out of taking a 30 percent cut of paid online events organized by small businesses and hosted on Facebook—things like cooking classes, workout sessions, and happy hours. Demand for these kinds of online events has soared during the COVID-19 pandemic.

Apple says that it has a longstanding policy that digital products must be purchased using Apple’s in-app payments system—and hence pay Apple’s 30 percent tax. In contrast, companies selling physical goods and services are not only allowed but required to use other payment methods (options here include Apple Pay, which doesn’t take such a big cut).

For example, an in-person cooking class is not a digital product, so a business selling cooking class tickets via an iPhone app wouldn’t have to give Apple a 30 percent cut. But if the same business offers a virtual cooking class, Apple considers that to be a digital product and demands a 30 percent cut—at least if the customer pays for the class using an iOS device.

Last month, Facebook announced it would start offering a new feature for small businesses to host paid online events. Facebook has waived any fees for the first year, allowing small businesses to pocket 100 percent of the revenue. But Apple refused to budge on its 30 percent take.

The issue came to a head in late August when Facebook revealed that Apple wouldn’t even allow Facebook to inform users about Apple’s 30 percent take. Facebook wanted to have a message on the checkout screen that said “Apple takes 30 percent of this purchase.” But Apple deemed this message “irrelevant” and forced Facebook to remove it before approving Facebook’s update.

The reprieve is only temporary. Apple says it has given Facebook until the end of the year to switch from Facebook Pay to in-app purchases—and hence start paying Apple 30 percent—for online events. Apple is extending the same courtesy to Airbnb and ClassPass.

However, this grace period isn’t available for Gaming Creators, which Apple argues are not brick-and-mortar businesses that have been affected by COVID-19.

https://arstechnica.com/?p=1709773

Fortune 500 companies aren’t the only ones flocking to cloud services like Microsoft Azure. Increasingly, hackers working on behalf of the Chinese government are also hosting their tools in the cloud, and that’s keeping people in Redmond busy.

Earlier this year, members of the Microsoft Threat Intelligence Center suspended 18 Azure Active Directory applications after determining they were part of a sprawling command-and-control network. Besides the cloud-hosted applications, the members of the hacking group Microsoft calls Gadolinium also stored ill-gotten data in a Microsoft OneDrive account and used the account to execute various parts of the campaign.

Microsoft, Amazon, and other cloud providers have long touted the speed, flexibility, and scale that comes from renting computing resources as needed rather than using dedicated servers in-house. Hackers seem to be realizing the same benefits. The shift to the cloud can be especially easy thanks to free trial services and one-time payment accounts, which allow hackers to quickly get up and running without having to have an established relationship or even a valid payment card on file.

At the same time, Gadolinium has embraced another trend found in organized hacking circles—the move away from custom malware and the increased use of open source tools, such as PowerShell. Because the tools are so widely used for benign and legitimate tasks, their malicious use is much harder to detect. Rather than rely on custom software for controlling infected devices, Gadolinium has recently begun using a modified version of the open source PowerShell Empire post-exploitation framework.

In a post published on Thursday, Microsoft Threat Intelligence Center members Ben Koehl and Joe Hannon wrote:

Historically, GADOLINIUM used custom-crafted malware families that analysts can identify and defend against. In response, over the last year GADOLINIUM has begun to modify portions of its toolchain to use open-source toolkits to obfuscate their activity and make it more difficult for analysts to track. Because cloud services frequently offer a free trial or one-time payment (PayGo) account offerings, malicious actors have found ways to take advantage of these legitimate business offerings. By establishing free or PayGo accounts, they can use cloud-based technology to create a malicious infrastructure that can be established quickly then taken down before detection or given up at little cost.

Gandolinium’s PowerShell Empire toolkit lets the attack group seamlessly load new modules using Microsoft programming interfaces. It also allows attacker-controlled OneDrive accounts to execute commands and receive the results sent between attacker and victim systems.

“The use of this PowerShell Empire module is particularly challenging for traditional SOC monitoring to identify,” the researchers wrote, referring to the systems operation centers where security teams monitor customer networks for signs of cyberattacks. “The attacker uses an Azure Active Directory application to configure a victim endpoint with the permissions needed to exfiltrate data to the attacker’s own Microsoft OneDrive storage.”

Agility and scale work both ways

But while the cloud provides benefits to the attackers, those benefits work both ways. Because the attacks were delivered using spear-phishing emails containing malicious attachments, they were detected, blocked, and logged by Microsoft Defender. And eventually, they were linked back to infrastructure hosted in Azure.

“As these attacks were detected, Microsoft took proactive steps to prevent attackers from using our cloud infrastructure to execute their attacks and suspended 18 Azure Active Directory applications that we determined to be part of their malicious command & control infrastructure,” Thursday’s post continued. “This action helped transparently protect our customers without requiring additional work on their end.”

Microsoft said it also took down a GitHub account Gadolinium used in similar attacks in 2018.

Microsoft is now releasing digital signatures and profile names known to have been used by Gadolinium. People and organizations can use them to tell if they or customers were victims or intended victims of any hacking by the group.

“Gadolinium will no doubt evolve [its] tactics in pursuit of its objectives,” the post concluded. “As those threats target Microsoft customers, we will continue to build detections and implement protections to defend against them.”

https://arstechnica.com/?p=1709604

A federal judge today gave the Trump administration until Friday to either defend its planned ban of short-form-video app TikTok in court or hold off on it, adding one more wrinkle to the seemingly endless on-again, off-again saga.

If the government doesn’t voluntarily postpone the planned TikTok ban by 2:30pm EDT on Friday, then it will have to show up for a hearing on Sunday morning, where he will rule on TikTok’s request for an injunction on the ban, Judge Carl Nichols of the US District Court for DC said today.

Nichols said that the ban, if it takes effect, could prevent potentially hundreds of thousands of new users per day from signing up for TikTok. “I don’t think [a ban] merely preserves the status quo,” he said, according to The Wall Street Journal.

President Donald Trump signed an executive order banning TikTok and another China-based app, WeChat, on August 6. The executive orders declared the apps to be a “national emergency,” but they did not specify what would be banned or how. TikTok filed suit against the administration within a week, arguing the proposed ban was both unconstitutional and politically driven.

TikTok filed its request for an injunction on the ban (PDF) on September 18, the day the administration finally made clear what a ban would actually involve. That injunction is what Nichols will rule on this Sunday, unless the administration agrees to postpone the ban.

The administration’s ban on TikTok was initially scheduled to go into effect at 11:59pm on Sunday, September 20. On Saturday evening, the Department of Commerce extended that deadline by one week to Sunday, September 27, after President Trump gave his conditional “blessing” to a deal between TikTok and Oracle.

The fate of that transaction, however, is anything but certain. Not only do Oracle and TikTok parent company ByteDance not seem to agree on what the terms of the deal actually are, but approval does not seem to be forthcoming from Chinese authorities.

An editorial in the state-run China Daily yesterday described the White House’s efforts to force a transaction as a “dirty and underhanded trick.”

“What the United States has done to TikTok is almost the same as a gangster forcing an unreasonable and unfair business deal on a legitimate company,” the government-sponsored paper wrote. “China has no reason to give the green light to such a deal, which is dirty and unfair and based on bullying and extortion. If the US gets its way, it will continue to do the same with other foreign companies. Giving in to the unreasonable demands of the US would mean the doom of the Chinese company ByteDance.”

It is unclear what the fate of TikTok will be inside the United States if the Chinese government does not approve the transaction. The president is also threatening to revoke his approval of the deal if he does not find it sufficiently spins off control of TikTok and its assets to US owners.

https://arstechnica.com/?p=1709436

On Wednesday, California Governor Gavin Newsom signed an executive order requiring that all new passenger cars and trucks sold in the state from 2035 be zero-emissions vehicles. Additionally, all drayage trucks—the ones that move containers around at places like the Port of Los Angeles—must also go emissions free by this date, as well as off-road vehicles and equipment. Medium- and heavy-duty vehicles get an extra decade to comply, but by 2045 these too must ditch internal combustion engines.

Although this is the first such ICE ban in the United States, Governor Newsom is following in the footsteps of policymakers in Europe, China, and elsewhere. In 2016, Paris, Madrid, Athens, and Mexico City announced bans on new diesel vehicles from 2025. The same year, Germany’s Bundesrat voted to outlaw new ICE vehicles from 2030, although this was not a binding resolution.

The following year, France announced that new ICE vehicles would be banned from 2040. The UK also picked 2040 as the end of new gasoline and diesel vehicles within its borders, a timeline that in February was brought forward by five years to 2035, then this past Monday it was brought forward another five years, to 2030. And China is also phasing out internal combustion vehicles, albeit over a longer timeline.

We should note that California’s ban will only apply to new gasoline- or diesel-powered vehicles sold in the state after it goes into effect. Cars and trucks already on the road and registered before 2035 will remain road-legal.

“This is the most impactful step our state can take to fight climate change,” said Governor Newsom. “For too many decades, we have allowed cars to pollute the air that our children and families breathe. Californians shouldn’t have to worry if our cars are giving our kids asthma. Our cars shouldn’t make wildfires worse—and create more days filled with smoky air. Cars shouldn’t melt glaciers or raise sea levels threatening our cherished beaches and coastlines.”

https://arstechnica.com/?p=1709196

The Department of Justice today dropped a proposed “recalibration” of one of the most important laws governing the US Internet into Congress’ lap and urged legislators to act to remove a liability protection on which nearly every website and app currently relies.

Attorney General Bill Barr sent the proposed legislation—an extension of his June wish list—to Speaker of the House Nancy Pelosi and Vice President Mike Pence (in his role as president of the Senate) this morning.

“For too long Section 230 has provided a shield for online platforms to operate with impunity,” Barr said in a written statement. “Ensuring that the Internet is a safe, but also vibrant, open, and competitive environment is vitally important to America,” he added. “We therefore urge Congress to make these necessary reforms to Section 230 and begin to hold online platforms accountable both when they unlawfully censor speech and when they knowingly facilitate criminal activity online.”

What is Section 230?

“Section 230” is the nickname for a very short part of the law under which Internet companies have been regulated since 1996. The key part of § 230 of the Communications Decency Act currently reads:

No provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider.

Those 26 words are included under the subheading, “Protection for ‘Good Samaritan’ blocking and screening of offensive material,” which allows Internet platforms to moderate user content shared on those platforms more or less however they wish—heavily, moderately, or not at all. Broadly speaking, it means that if you use an Internet service to say something obscene or unlawful, then you, not the Internet service, are the one responsible for having said the thing, and the Internet service has legal immunity from whatever you said. (That’s the short version. For the long version, give Ars’ own Tim Lee’s explanation of the law and its history a read.)

What does the DOJ propose changing?

While the proposal (PDF) leaves the core principle of Section 230 unaltered, it immediately applies a big honking qualifier.

That qualifier says that the existing law won’t apply “to any decision, agreement, or action by a provider or user” of an Internet service “to restrict access to or availability of material provided by another information content provider.” That seems to mean that a service such as Twitter or Facebook would not be permitted to block users from sharing URLs to, for example, hate sites.

The proposed new bill legislation also adds several explicit carve-outs to the law. The first is a “bad Samaritan” carve-out, exempting a platform from qualifying for section 230 immunity if it “acted purposefully with the conscious object to promote, solicit, or facilitate material or activity… that the service provider knew or had reason to believe would violate Federal criminal law.”

“Criminal material” also has an explicit carve-out that would require platforms to remove or restrict access to that material and report it to law enforcement as soon as they received notice of it—a mechanism seemingly inspired by the way copyright takedown requests work today.

The last carve-out applies to “judicial decisions.” If a court rules that any content posted to a service is “Defamatory under state law or unlawful in any respect,” platforms would have to remove that content as well.

The last page of the proposed legislation adds a list of “good faith” requirements. In order to be considered to be acting in good faith, a platform must have a publicly available terms of service that includes its moderation rules; must moderate content “consistent with” those terms of use; must not block content on “deceptive or pretextual grounds”; and must supply the entity being moderated with “reasonable factual basis for the restriction of access and a meaningful opportunity to respond.”

“A platform that chooses not to host certain types of content would not be required to do so,” is how Barr described it to Pelosi and Pence, “but it must act in good faith and abide by its own terms of service and public representations. Platforms that fail to do those things should not enjoy the benefits of Section 230 immunity.”

Companies are already required to adhere to the terms of service they provide to customers, for what it’s worth. The FTC is responsible for enforcing consequences against companies it finds to have used misleading or deceptive terms of service, including, in 2011, both Facebook and Twitter.

Why now?

Barr’s line about platforms “unlawfully censoring” speech is the true crux of the issue: the Trump administration has for several years claimed that social media platforms such as Facebook and Twitter have an anti-conservative bias and unlawfully stifle right-wing content. The administration has been seeking ways to alleviate the alleged “bias” by changing the laws that apply to the social media sector, including Section 230.

These assertions of bias are not supported by any evidence to date. A cursory look at the evidence, in fact, tends to support the opposite conclusion. President Donald Trump himself has more than 86 million followers on Twitter—not the most-followed account, but comfortably within the top 10. Over on Facebook, the top 10 highest-traffic posts on any given day are almost all from conservative sources. Facebook itself tried to identify anti-conservative bias on its platform but did not find any. Stories from several organizations, including a recent Bloomberg cover story, find exactly the opposite, reporting that Facebook has instead worked to accommodate the Trump campaign and conservative outlets.

Nonetheless, Trump signed an executive order in May targeting online platforms. That order has a three-pronged approach, asking the Federal Communications Commission, Federal Trade Commission, and Department of Justice each to undertake some part of the enforcement.

Is the proposed law… legal?

If Congress were to pass the law, it would almost certainly face near-immediate legal challenge.

The proposal is not far off the FCC’s “must-carry” rules for broadcasters, said Gautam Hans, a professor of law at Vanderbilt University and director of the Stanton Foundation First Amendment Clinic.

“My biggest concern is that it seems to be proscribing the platform’s ability to take down content,” Hans added. “In effect, this is attempting to create ‘must carry’ obligations for certain kinds of speech.” Hans added that the proposal amounts to “hypocrisy” on the part of conservatives, as compared to the Fairness Doctrine getting axed during the Reagan administration.

“There is much to criticize about Section 230, how platforms have responded to its framework, and the way it has played out in the courts—but this is hardly the path forward we should take,” Hans concluded. “I suspect that the platforms would have some good First Amendment arguments if this legislation went into effect.”

Consumer-advocacy group Free Press also had a withering take on the proposal. “The draft legislation from the Department of Justice is a naked attempt to silence anyone who attempts to correct or criticize Trump, his allies, and fellow travelers,” Free Press senior policy counsel Gaurav Laroia said. “It would incentivize platforms to host content created by racists, sexists, propagandists, and trolls. This legislation would also open the door to those who want to drown the Internet in an ocean of disinformation and toxicity.”

Aside from the content, the proposed recalibration also may not be a particularly well-crafted piece of legislation. Blake Reid, a professor of technology and telecom law at the University of Colorado at Boulder observed in a series of tweets that the proposal, as structured, doesn’t particularly hold together as a legal argument. “I have no idea how courts would interpret this because it just doesn’t make any sense,” Reid wrote. “This is not a long statute. But after trying to parse this proposal for half an hour I’m left with major questions about what it’s even trying to accomplish.”

Still just a wish list

Now, the House and Senate can take the draft legislation under consideration and probably do exactly nothing with it, just as Congress has done with the last several tech-related bills. This particular proposed bill has the weight of the White House behind it, but the chances of it becoming law at this time are slim at best.

The administration’s proposed text is, in fact, similar to a bill that Sens. Roger Wicker (R-Miss.), Lindsey Graham (R-S.C.), and Martha Blackburn (R-Tenn.) introduced earlier this month in the Senate. Their version (PDF), called the Online Freedom and Viewpoint Diversity Act, is shorter but more directly targets Internet companies’ ability to moderate content on their platforms.

“The contentious nature of current conversations provides perverse incentive for these companies to manipulate the online experience in favor of the loudest voices in the room,” Blackburn said about that bill at the time. “There exists no meaningful alternative to these powerful platforms, which means there will be no accountability for the devastating effects of this ingrained ideological bias until Congress steps in and brings liability protections into the modern era.”

That bill is now sitting with the Senate Commerce Committee, where it is likely to languish until the current session of Congress expires in January. That, too, is almost certainly the fate of Barr’s proposal. As little appetite as both the House and Senate seemed to have for moving on tech legislation in 2019, the extraordinary maelstrom of circumstances created in 2020 by the confluence of the COVID-19 pandemic, the impending presidential election, and the recent passing of Supreme Court Justice Ruth Bader Ginsburg make lawmakers even less likely to take up any such bill in the immediate term.

That said, however: Section 230 is now almost 25 years old, and the Internet has changed significantly since its adoption. The DOJ’s proposal is not the first attempt to amend it, and it will not be the last.

https://arstechnica.com/?p=1709042

T-Mobile US CEO Mike Sievert yesterday fired back at AT&T and Verizon, saying the carriers’ complaints about T-Mobile obtaining more spectrum licenses show that they are afraid of competition.

“The duopolists are scrambling to block this new competition any way they can… Suddenly in the unfamiliar position of not having a dominant stranglehold on the wireless market, and preferring not to meet the competitive challenge in the marketplace, AT&T and Verizon are urging the FCC to slow T-Mobile down and choke off our ability to compete fairly for added radio spectrum,” Sievert wrote in a blog post.

As we wrote Monday, Verizon and AT&T have urged the Federal Communications Commission to impose limits on T-Mobile’s ability to obtain more spectrum licenses. AT&T complained that T-Mobile’s acquisition of Sprint allowed it to amass “an unprecedented concentration of spectrum.”

Verizon in August petitioned the FCC to reconsider its acceptance of a new lease that would give T-Mobile another 10MHz to 30MHz of spectrum in the 600MHz band in 204 counties. But “the main event,” according to Sievert, is the FCC’s upcoming C-band spectrum auction in December, which will distribute 280MHz of spectrum in the 3.7–3.98GHz band.

“Anticipated to raise many billions of dollars for American taxpayers, the C-band is the largest pool of new spectrum expected any time in the near future,” Sievert wrote. “The results of the auction will shape market competition and network advancement in the US for years to come.”

Verizon told the FCC that “T-Mobile already holds licenses for 311MHz of low- and mid-band spectrum nationwide,” more than AT&T and Verizon combined and well above the FCC’s 250MHz “spectrum screen.” The FCC uses this spectrum screen as one data point in its public-interest analyses, but the 250MHz screen isn’t a hard-and-fast limit, and T-Mobile says it should be allowed to purchase more spectrum licenses.

Sievert pointed out that Verizon has more spectrum than T-Mobile when including high-band spectrum that isn’t counted in the FCC’s screen:

Citing the “spectrum screen”, AT&T and Verizon would like to keep T-Mobile out of the bidding or at least put a damper on our ability to aggressively bid against them in this important auction, so that they can run the table unchecked. The “spectrum screen” was put in place years ago with good intention and broad support including from T-Mobile—to help ensure competition in the market when spectrum supply was limited—but is now being cited by AT&T and Verizon for reasons entirely opposite to this intention. And importantly, the “spectrum screen” pre-dates, and therefore ignores, certain 5G spectrum where Verizon already dominates. In fact, Verizon holds massive spectrum (far more than T-Mobile’s entire portfolio of low, mid-, and high-band spectrum) in the “millimeter wave” bands, which are the cornerstone of their 5G strategy and which are not subject to the “spectrum screen”.

Verizon has the most spectrum of any US carrier “by far” but “has the anti-competitive instincts and sheer audacity to complain that a much smaller T-Mobile has too much,” Sievert wrote. “After holding massive spectrum advantages over T-Mobile and others for decades, Verizon and AT&T just can’t stand the idea of anyone else being ahead of them or having a fair shot in an auction where they plan to use their financial might to do what they have always done—dominate.”

Sievert also wrote that the 600MHz spectrum T-Mobile is leasing was previously controlled by AT&T. “AT&T had won at auction the spectrum that Columbia Capital is now leasing to T-Mobile and—guess what—AT&T decided it didn’t want it and sold it to Columbia,” Sievert wrote. “Verizon, the ringleader in opposing this lease, never bothered to even show up and bid for any 600MHz spectrum. In short, we have AT&T and Verizon seeking to block T-Mobile from using spectrum that AT&T decided to jettison, and Verizon had no interest in pursuing. Now both companies are seeking to block T-Mobile from putting this spectrum to use for the benefit of American consumers.”

Fight to continue ahead of auction

The dueling statements suggest that the carrier battle will continue in the months ahead as the C-band auction draws near. “If T-Mobile participates in the auction, the Commission will almost certainly be forced to contend—for the first time—with the situation of applying its spectrum screen (and post-auction case-by-case review) to an acquisition of licenses by an applicant whose holdings already exceed the screen by a wide margin,” AT&T said in its FCC filing last week.

The spectrum screen is likely to be raised from 250Mhz to 345MHz after the auction to account for increased availability of licenses, AT&T said. T-Mobile already has more than 345MHz in some parts of the US, and there are “many other” US markets where T-Mobile would exceed 345MHz if it wins any spectrum in the auction, AT&T said.

The auction is scheduled to begin on December 8, and preliminary “short-form” applications were due yesterday. The FCC will review the applications and then release a list of bidders.

https://arstechnica.com/?p=1709145

When state Senator Bob Hertzberg learned that an ambitious privacy initiative had gotten enough signatures to qualify for the ballot in California, he knew he had to act quickly.

“My objective,” he says, “was to get the damn thing off the ballot.”

It was the spring of 2018. Facebook’s emerging Cambridge Analytica scandal had cast a harsh light on the tech giants’ data-gathering practices, spurring calls for more consumer privacy protections. The initiative was the brainchild of Alastair Mactaggart, a wealthy San Francisco real estate developer, who had the idea in the shower in 2015 and funded the effort out of pocket. Mactaggart enlisted his neighbor Rick Arney and Mary Stone Ross, a former CIA analyst and lawyer, to help craft the ballot measure. None had any background in data privacy or, for that matter, anything related to the tech industry.

“No one knew who Alastair was,” says Hertzberg, a longtime fixture of California politics whose district includes parts of Los Angeles. “Who is this guy, and where is he coming from? All of a sudden he writes a check, spends a couple years, does some homework, and does a ballot initiative.” If enough voters approved the initiative that fall, it would put in place extensive new regulations that could only be amended if the legislature mustered a 70 percent supermajority.

The prospect alarmed Hertzberg and some of his colleagues. “The reason we thought it was horrible wasn’t because he didn’t do a lot of good things that were consumer-facing; of course he did. But he put a 70 percent threshold. And in my world, a 70 percent threshold basically gives the other party all the power.”

Much better, he thought, to address the problem of data privacy through the legislative process. So Hertzberg approached Mactaggart with a deal: work with him to craft a bill and, once it passes, withdraw the ballot initiative. Mactaggart agreed. That June, after a few months of intense negotiation, the legislature unanimously passed the California Consumer Privacy Act. It was the most ambitious data privacy law in the nation—but it quickly proved inadequate. The rushed and contentious drafting process left enormous loopholes in the law, and it didn’t provide the resources necessary for its own enforcement. Legislators spent the early part of 2019 introducing bills to fix those flaws before the law took effect but didn’t get anywhere. (There was also a series of bills that tried, and failed, to pare back the law further.)

So, about a year after the CCPA was passed—but before it had gone into effect—Hertzberg, who by then was majority leader of the California State Senate, pitched a new idea to Mactaggart. In a total reversal from his earlier stance, Hertzberg urged Mactaggart to bypass the legislative process. Instead, he should fund and draft a new ballot initiative to improve upon the CCPA. And this one wouldn’t be a bargaining chip. It would go all the way to a vote by the people of California. Thus was born the California Privacy Rights Act, which will appear on Californians’ ballots this fall as Proposition 24.

“We have to go back to the ballot”

“The only way we’re going to do this is, we have to go back to the ballot,” Hertzberg recalls saying. Legislation looked like a dead end. “Because we had made mistakes—not horrible mistakes, but mistakes—in CCPA, all the business people were using it to cut up our credibility. Washington people were saying, ‘See, California doesn’t know what they’re doing.’ Given the timing, given the speed, we realized that we had to do another initiative.”

Hertzberg’s flip-flop on the ballot initiative question is just one way in which Proposition 24 has scrambled political dynamics in California. The initiative has also divided privacy advocates who previously fought on the same side. Mactaggart’s former ally, Ross, is leading the opposition and has enlisted allies that include the American Civil Liberties Union and consumer-advocacy groups. “The CCPA was a lot weaker than the [original] initiative, but at the same time it was, and still is, the strongest consumer privacy law in the nation,” she says. “And this initiative weakens it.”

Whenever regulation is on the table, members of the affected industry can be expected to line up in opposition. But privacy advocates resisting a privacy initiative is less intuitive. How did Proposition 24 upend these alliances? The answer is: it’s complicated. Not just the situation, but the measure itself.

Problematic predecessor

You can’t understand Proposition 24 without first understanding how lame the CCPA turned out to be.

The law was intended to give Californians the right to know what data businesses are collecting about them, to opt out of the sale of that data, and to make businesses delete the data they’ve already gathered. But those rights are mostly theoretical, thanks to a handful of missteps by the law’s drafters. First, the CCPA specifies that users have the right to opt out of the “sale” of their data. But tech companies argue that many transfers of user information that seem to raise privacy concerns aren’t sales at all, because no one is paying for data: websites commonly give user data to third parties like Facebook in order to more effectively sell subscriptions and advertising.

“We did all this work and Google can still take all your information, Facebook can still put a pixel on a website.”

Second, the CCPA ended up including an exception for “service providers” who need user data to perform a “business purpose.” Companies like Facebook and Google have seized on that language, arguing that they provide the service of microtargeted advertising. Taken together, the two provisions essentially exempt targeted advertising from the privacy law—which, given how central advertising is to all the tracking of users online, is a bit like exempting coal plants from a law promoting clean air.

“The ‘sale’ and the ‘service provider’ issue are two huge loopholes that companies are currently exploiting,” says Justin Brookman, the director of consumer privacy and technology policy at Consumer Reports. “If you say, ‘Do not sell’ today, many companies are doing nothing.”

Mactaggart rues the fact that, as he sees it, tech lobbyists managed to get the service provider clause into the bill. “I caught a bunch of the things they were trying to do, but I didn’t catch this one.” As a result, he says, when it comes to cutting down on the biggest sources of online tracking, “We literally didn’t do anything. We did all this work and Google can still take all your information, Facebook can still put a pixel on a website. All they have to do is have a contract with that website, and one of the business purposes says ‘advertising and marketing,’ and boom.”

The other big CCPA shortcoming is enforcement. The original ballot-initiative version of the law would have let any Californian sue a company that violated its provisions—a so-called private right of action. But that provision, which tech companies vehemently opposed, got killed in the negotiation process. In the end, the law gives the state attorney general the exclusive power to enforce it. (Ross disagreed so bitterly with that concession, along with giving up on the 70 percent threshold, that she and Mactaggart stopped speaking.)

Enter the attorney general

“One decision we made was, we’re just going to give the power to oversee this to the California attorney general,” says Hertzberg. That position is currently held by Xavier Becerra, a fellow Democrat. “I thought I was doing him a big favor by giving him the power to ultimately decide all these issues in privacy,” Hertzberg says. In fact, Becerra has said his office only has the resources to bring a handful of cases a year. Even if he had more, the law lets businesses avoid punishment if they “cure” a violation that gets flagged. There is little reason for businesses to take it very seriously.

Data from the first six months of the law’s existence suggests that it hasn’t changed the privacy game for consumers all that much, either. According to an analysis by DataGrail, a company that helps businesses comply with privacy laws, there were only 82 “Do not sell” requests for every million consumer records in that timespan.

The point of Proposition 24 is to patch the holes currently making the CCPA such a leaky privacy vessel. If approved by California voters, the initiative would change the law’s “Do not sell” provision to “Do not sell or share” to eliminate any wiggle room for unremunerated data transfers, and it clarifies that targeted advertising does not count as a “business purpose” that exempts companies from complying with user opt-outs. It also aims to beef up enforcement by requiring the legislature to appropriate $10 million in annual spending for an entire new privacy-protection agency. And unlike the 2018 ballot initiative, Proposition 24 allows the legislature to make future changes with a simple majority vote—but only if those changes enhance, rather than weaken, the purposes of the law.

“We’re not trying to create a new ceiling, we’re trying to raise the floor,” says Andrew Yang, the former presidential candidate. Yang, who chairs the advisory board for Mactaggart’s Californians for Consumer Privacy, is one of several prominent supporters of the initiative, along with congressman Ro Khanna and tech theorist Shoshana Zuboff. “It preempts tech companies’ ability to water down the CCPA and make it toothless. And it leaves up to all of us how we want to continue to develop people’s privacy rights and data rights. If it doesn’t include everything that you want, fantastic—let’s get this one in place and then champion something else that continues to raise the floor.”

https://arstechnica.com/?p=1708760