In court documents that surfaced this weekend, Microsoft offered its support for Epic Games in the Unreal Engine-maker’s quickly unfolding legal battle with Apple over access to the iOS app marketplace.

The legal declaration from Microsoft Gaming Developer Experiences General Manager Kevin Gammill comes in response to Apple’s threat to halt Epic’s access to software development tools used to update its popular Unreal Engine for use on iOS. That threat itself came after Epic tried to use its own payment system in the iOS version of Fortnite to get around Apple’s 30-percent platform fee. That move quickly got the game pulled from the Apple App Store and led Epic to file a lawsuit in response.

Gammill says that any move harming development of Epic’s Unreal Engine on iOS would hurt Microsoft’s business, because “in Microsoft’s view there are very few other options available for creators to license with as many features and as much functionality as Unreal Engine across multiple platforms, including iOS.”

“Ensuring that Epic has access to the latest Apple technology is the right thing for gamer developers & gamers,” Microsoft’s Head of Xbox Phil Spencer added while tweeting a link to the declaration Sunday.

Microsoft uses Unreal Engine for iOS games such as Forza Street, and Gammill says Epic’s software is “critical technology for numerous game creators, including Microsoft… if Unreal Engine cannot support games for iOS or macOS, Microsoft would be required to choose between abandoning its customers and potential customers on the iOS and macOS platforms or choosing a different game engine when preparing to develop new games.”

Developers currently working on Unreal Engine projects for Apple hardware would have to incur significant costs to start over, Gammill said, while developers with current Unreal Engine apps on iOS will be stuck with an engine that can’t “take advantage of new iOS or macOS features, fix software bugs, or patch security flaws.

“In addition, this situation could bifurcate a game’s player base, such that gamers on iOS or macOS cannot play or communicate with friends or family who are playing on other platforms,” Gammill added.

Chilling retaliation?

In court documents filed late last week, Apple argues that the “irreparable harm” Epic claims Apple is causing in this matter is actually the “self-inflicted… result of its choice to breach its agreements” with Apple. All of these problems can go away, Apple asserts, if Epic resubmits a version of Fortnite that complies with the App Store’s standard in-app purchase rules (including Apple’s 30-percent fee).

“The harm raised by Epic here is completely avoidable—here and now,” Apple writes. “The asserted harm to Epic customers, whether of Fortnite or Unreal Engine, can be ended by Epic. All of the users and developers that Epic asserts are at risk are disadvantaged only because Epic’s scheme included breaching its agreements and running into court for relief. Epic has put customers and developers in this position, not Apple.”

In its response filing, though, Epic asserts that any issues surrounding Fortnite should not affect Epic’s ability to separately continue developing Unreal Engine for iOS. That’s because Apple’s Program License Agreement—which Apple says Epic breached with its Fortnite direct payment plan—is completely separate from its XCode and Software Development Kit agreement—which governs the testing and development of Unreal Engine on the platform.

“The breadth of Apple’s retaliation [against Unreal Engine development] is itself an unlawful effort to maintain its monopoly and chill any action by others who might dare oppose Apple,” Epic writes in urging the court to block Apple’s threatened action. “Epic asks only that the Court preserve the status quo so that Epic continues to have the same access to software, software development kits (“SDKs”), application programming interfaces (“APIs”) and other developer tools that it has today.”

Strange bedfellows

Separate from Epic’s battle, Microsoft is also waging its own PR war against Apple over the blocking of an iOS version of its xCloud game streaming platform. “Apple stands alone as the only general purpose platform to deny consumers from cloud gaming and game subscription services like Xbox Game Pass,” Microsoft said earlier this month. “And it consistently treats gaming apps differently, applying more lenient rules to non-gaming apps even when they include interactive content.”

But Microsoft and Epic make somewhat strange legal bedfellows. As recently as 2016, the two companies publicly sparred over similar platform control issues raised by Microsoft’s Universal Windows Platform, which Epic called a “fiasco” and “the most aggressive move Microsoft has ever made.” Epic and Microsoft publicly buried the hatchet last year, though, with Epic CEO Tim Sweeney telling VentureBeat “Epic loves Microsoft. Epic hearts Microsoft.”

Microsoft also exercises strict, iOS-style control over the software market on Xbox consoles and extracts a similar 30-percent fee for in-game items sold on the platform. But Sweeney has said these console markets are different from mobile platforms because of console-makers’ “enormous investment in hardware, often sold below cost, and marketing campaigns in broad partnership with publishers.” https://arstechnica.com/?p=1700858

Federal prosecutors have charged former Uber security chief Joe Sullivan with obstruction of justice for hiding a 2016 data breach from Federal Trade Commission investigators. Sullivan is now the chief security officer at Cloudflare.

In an emailed statement, a spokesman for Sullivan said the government’s charges have “no merit.”

“From the outset, Sullivan and his team collaborated closely with legal, communications and other relevant teams at Uber, in accordance with the company’s written policies,” the spokesman wrote. “Those policies made clear that Uber’s legal department—and not Mr. Sullivan or his group—was responsible for deciding whether, and to whom, the matter should be disclosed.”

The criminal complaint, filed Thursday, suggests that Uber’s then-CEO Travis Kalanick was aware of the breach and Sullivan’s efforts to cover it up. It also concedes that Uber’s general counsel may have been aware of the breach by April 2017. But it argues that Sullivan kept others involved in Uber’s FTC response in the dark about the incident.

Two breaches, two years apart

In 2014, Uber suffered a data breach after hackers found cloud storage credentials hard-coded in Uber source code that an Uber engineer accidentally published on GitHub. The credentials provided access to live data stored on Amazon’s S3 cloud storage service. The hackers gained access to names and driver’s license numbers for around 100,000 Uber drivers, as well as a much smaller number of bank account and Social Security numbers.

The breach triggered an investigation by the Federal Trade Commission. In November 2016, the FTC interviewed Sullivan. He had joined Uber in 2015 after five years as Facebook’s chief security officer (we interviewed him in 2013 and 2014), so he hadn’t been around during the 2014 breach. But as Uber’s new security chief, it was his job to explain the situation to the FTC’s investigators.

According to the criminal complaint, Sullivan “elaborated that it was common at the time to write access IDs and other secrets directly into code when that code needed to call for information from another service.”

Ten days after his testimony, Sullivan learned that Uber had suffered a second breach that was a near replay of the first one. This time, a hacker reportedly stole credentials to gain access to Uber’s private code on GitHub. And that code still had some hard-coded Amazon S3 credentials. The hackers gained access to around 600,000 names and drivers’ license numbers.

Uber paid the hackers to stay quiet

Uber’s security team immediately recognized that it would be embarrassing to announce a second breach while the FTC was still investigating the first one. “Information is extremely sensitive and we need to keep this tightly controlled,” one internal document said.

So Uber decided to treat the breach as part of its bug bounty program. Under that program, Uber pays white-hat hackers for information about vulnerabilities in its software. Ordinarily, payments are less than $10,000 and hackers aren’t supposed to exploit vulnerabilities to access user data. And in bug bounty cases, hackers are allowed to publicly disclose a vulnerability once Uber has fixed the vulnerability.

But Uber’s lawyers wrote a special contract for these hackers. In exchange for an unusually large $100,000 payment, the hackers signed a strict non-disclosure agreement. The deal asked hackers to state—falsely—that they had not accessed any user data.

According to prosecutors, Kalanick was aware of this plan. At 1am on November 15, Sullivan texted Kalanick. “I have something sensitive I’d like to update you on if you have a minute,” he wrote.

Ten minutes later—and presumably after a phone conversation—Kalanick texted Sullivan back. “Need to get certainty of what he has, sensitivity/exposure of it and confidence that he can truly treat this as a 🐛 bounty situation… resources can be flexible in order to put this to bed but we need to document this very tightly.”

It was a full year before the FTC learned about the 2016 breach. Kalanick was forced out as Uber’s CEO in June 2017 and replaced by Dara Khosrowshahi a couple of months later. When Khosrowshahi learned about the situation, he fired Sullivan and reported the new breach to the FTC. The FTC withdrew a tentative settlement agreement and the investigation dragged on for another year before the case was finally settled in 2018.

The feds say Uber’s cover-up may have prevented law enforcement from bringing the hackers to justice earlier. In the year between the breach and Uber’s disclosure of it, the pair used similar techniques to hack several other large companies. If Uber had reported the breach promptly, it’s possible that the feds would have caught the hackers responsible much earlier and saved some other companies from the same fate.

Who knew what, and when?

The government’s complaint doesn’t accuse Sullivan of directly lying to the FTC. But it portrays Sullivan as the mastermind of Uber’s efforts to keep the FTC in the dark.

Sullivan’s press statement suggests that he will fight the charges by arguing that he wasn’t personally responsible for Uber’s handling of the situation. The government’s brief acknowledges that Kalanick also knew the breach occurred and authorized an unusually large payment to the hackers to keep it under wraps. But the government claims that few others at Uber knew about it.

For example, Sullivan was consulted on a draft of a letter Uber sent to the FTC in April 2017. It touted Uber’s record of cooperation with the agency, including its practice of voluntarily submitting relevant information to the agency. In response, Sullivan wrote, “Letter looks ok to me.”

The final version of that letter touted the new security measures Uber had put into place since the 2014 breach, including “extensive additional protections for the data it stores [Uber] stores in the S3 datastore” and “company-wide improvements in credential protection and management.”

FBI agent Mario Scussel, the author of the government complaint, wrote that “based on my investigation, I do not believe that any of the individuals responsible for drafting the April 19 letter to the FTC had been made aware of the 2016 data breach.” But in a footnote, he hedges this broad statement, acknowledging that Uber’s general counsel may have known the breach occurred. He added, “I have seen no evidence that the general counsel was aware of the details, such as the nature of the attack or the PII that was stolen.”

https://arstechnica.com/?p=1700528

An Apple engineer who helped launch the iPod said he helped the US government build a secret version of the device that could covertly collect data.

David Shayer, the second software engineer hired for the iPod project in 2001, said he first learned of the project in 2005, when he received an office visit from his boss’s boss.

“He cut to the chase,” Shayer recounts in a post published on Monday by TidBITS, an online newsletter covering all things Apple. “‘I have a special assignment for you. Your boss doesn’t know about it. You’ll help two engineers from the US Department of Energy build a special iPod. Report only to me.’”

Custom hardware, custom OS

Shayer said that over the next few months, he regularly helped the two men, who he identified only as engineers Paul and Matthew working for Bechtel (their purported redacted business cards are pictured above). There were mundane tasks, such as Shayer shuttling them from the lobby into the ultra secure quarters where iPod development took place.

And there were the not-so-mundane responsibilities of helping two outsiders to take Apple-provided source code and compile it into the operating system that ran what was quickly becoming perhaps the world’s most iconic music playing device. Among other things, Shayer helped the men find their way around the Windows-based developer tools Apple used at the time to build software for ARM chips.

Shayer said that Apple didn’t allow the engineers access to its source code server directly, but instead the company provided a copy of the source code on a DVD with the agreement it was never to leave the building. (Apple, Shayer said, ultimately allowed the men to retain the modified copy of the OS they created, but not the source code.)

Shayer continued:

As they learned their way around the system, they explained what they wanted to do, at least in broad strokes. They had added special hardware to the iPod, which generated data they wanted to record secretly. They were careful to make sure I never saw the hardware, and I never did.

We discussed the best way to hide the data they recorded. As a disk engineer, I suggested they make another partition on the disk to store their data. That way, even if someone plugged the modified iPod into a Mac or PC, iTunes would treat it as a normal iPod, and it would look like a normal iPod in the Mac Finder or Windows Explorer. They liked that, and a hidden partition it was.

Next, they wanted a simple way to start and stop recording. We picked the deepest preferences menu path and added an innocuous-sounding menu to the end. I helped them hook this up inside the code, which was rather non-obvious. In all other respects, the device functioned as a normal iPod.

A Geiger counter? Really?

Shayer said he never learned precisely what the modified iPod did. He knew that the engineers were combining the modified OS with some sort of hardware added to a fifth-generation iPod. The objective was to create a device that could record ambient data and write it to the device disk—all in a way that couldn’t be easily detected.

Based on the Department of Energy’s oversight of nuclear weapons and programs, he speculates that the secret iPod was to include a Geiger counter that could covertly sniff out stolen uranium, evidence of a dirty bomb development program, or similar things.

Apple didn’t respond to multiple emails sent over two days seeking comment for this post. Tony Fadell, who at the time was the senior VP of the iPod division, has taken to Twitter over the past two days to say Shayer’s account is accurate and to provide a few additional details. According to Shayer, Fadell was one of only four people inside Apple who knew of the project. Through a representative, Fadell declined to comment. Attempts to contact Shayer were unsuccessful.

“Absolutely spot on David Shayer,” Fadell, who inside Apple circles was sometimes called “the father of the iPod,” wrote. “This project was real w/o a doubt. There was whole surreal drama & interesting story about how this project was kicked off & then kept secret.”

While a secret iPod program sounds plausible and has the public corroboration of two reputable people in a position to know, there’s some understandable skepticism about the account. Chief among the doubts is that the government’s custom-made iPod would be used to measure radioactivity as opposed to, say, private conversations of high-value targets.

“I think it’s totally plausible that DOE was somehow involved in a feasibility study, e.g. ‘how big of a risk is this’ rather than ‘build this and we’ll deploy it,’” Jake Williams, a former hacker for the National Security Agency, told me. “That said, this sounds like something that you’d want for intelligence operations, particularly gifts to foreign dignitaries, HUMINT assets, etc.” HUMINT refers to human intelligence, or the gathering of information through personal contacts.

Williams, who after leaving the NSA cofounded Rendition Security, continued: “Pre-Snowden and Vault 7 this would have been Earth shattering. Not so much now. Unfortunately, as the author notes there is very intentionally no paper trail.”

With no paper trail, details of those few months 15 years ago will likely remain a closely guarded secret. No doubt, though, that the account makes for intrigue and almost irresistible speculation.

https://arstechnica.com/?p=1700318

In an attempt to mitigate the potential spread of COVID-19, one Michigan college is requiring all students to install an app that will track their live locations at all times. Unfortunately, researchers have already found two major vulnerabilities in the app that can expose students’ personal and health data.

Albion College informed students two weeks before the start of the fall term that they would be required to install and run the contact tracing app, called Aura.

Exposure notification apps being deployed by states, based on the iOS and Android framework that Apple and Google announced earlier this year, are designed to minimize harms to privacy. That framework basically uses a phone’s Bluetooth capabilities as a proximity sensor, to see if the phone it’s installed on has been near a phone of someone who reports having tested positive for COVID-19.

Aura, however, goes all in on real-time location-tracking instead, as TechCrunch reports. The app collects students’ names, location, and COVID-19 status, then generates a QR code containing that information. The code either comes up “certified” if the data indicates a student has tested negative, or “denied” if the student has a positive test or no test data. In addition to tracking students’ COVID-19 status, the app will also lock a student’s ID card and revoke access to campus buildings if it detects that a student has left campus “without permission.”

TechCrunch used a network analysis tool to discover that the code was not generated on a device but rather on a hidden Aura website—and that TechCrunch could then easily change the account number in the URL to generate new QR codes for other accounts and receive access to other individuals’ personal data.

A student at Albion, looking into the app’s source code, also found hard-coded security keys for the app’s backend servers. A researcher took a look and verified that those keys gave access to “patient data, including COVID-19 test results with names, addresses, and dates of birth,” TechCrunch reports.

Aura’s developer, Nucleus Careers, fixed both vulnerabilities after the researchers and TechCrunch contacted them about the vulnerabilities. Students and parents, however, are still not enthusiastic. “I think it’s more creepy than anything and has caused me a lot of anxiety about going back,” one Albion student told the site.

Campus complications

Colleges and universities around the nation are struggling desperately to find ways to manage the fall 2020 semester. Many are only offering online education this fall. Some tried opening as usual this month but quickly had to abandon their plans and switch to distance learning after clusters of COVID-19 cases popped up among the student body. Others are trying cautiously to find in-between paths that allow students to return to classrooms more safely.

Oakland University, also in Michigan, plans to deploy wearable health-tracking tech—a BioButton—to track symptoms and the potential spread of COVID-19 among the campus population. Initially the university planned to make the BioButton mandatory for all students living on-campus, but school leadership walked that back following a petition from students.

College campuses are an ideal test ground for an array of COVID contact-tracing efforts. Schools can require students to download and install apps in a way that health officials cannot with the general population—although, as Politico notes, students’ participation and compliance may be less than full and enthusiastic, particularly when it comes to disclosing contacts who may have been drinking while underage.

College surveillance

COVID-19 lends an aura of urgency to the matter, but invasive location tracking on college campuses is not new. Schools around the country have been building out tracking systems for several years.

In 2019, for example, the University of Alabama began using location-tracking technology to see which students were leaving football games early. Students who remained through the fourth quarter were more likely to be able to get tickets for championship games.

Other schools rely on Bluetooth beacons and campus WiFi networks to track students around campus, as The Washington Post reported last year. The data not only thoroughly tracks students and compares their behavior to “norms” generated by peers in their cohorts but also may be used for grading and attendance purposes. Students can’t opt out by, for example, leaving their phones turned off because then they are marked absent and face penalties. One student from Temple University also told the Post that the app his school tracked him with didn’t work, and administrators would not believe his word over the faulty data.

Facial recognition, too, is coming to higher education. Advocacy group Fight For the Future identified 10 campuses, out of a list of about 100, that are already using facial recognition technology on campus, with another 30 or so indicating they may choose to deploy it in the future.

School administrators are not the only ones desperate to follow students’ movement on, off, and around campus. Some worried parents have also turned to location tracking to keep a remote eye on their kids when those kids become adults and leave for college.

https://arstechnica.com/?p=1700210

AT&T and T-Mobile are fighting a Federal Communications Commission plan to require drive tests that would verify whether the mobile carriers’ coverage claims are accurate.

The carriers’ objections came in response to the FCC seeking comment on a plan to improve the nation’s inadequate broadband maps. Besides submitting more accurate coverage maps, the FCC plan would require carriers to do a statistically significant amount of drive testing.

“In order to help verify the accuracy of mobile providers’ submitted coverage maps, we propose that carriers submit evidence of network performance based on a sample of on-the-ground tests that is statistically appropriate for the area tested,” the FCC proposal issued in July 2020 said.

This could prevent repeats of cases in which carriers exaggerated their coverage in FCC filings, which can result in government broadband funding not going to the areas where it is needed most. Small carriers that compete against the big three in rural areas previously had to conduct drive tests at their own expense in order to prove that the large carriers didn’t serve the areas they claimed to serve.

FCC Chairman Ajit Pai did not punish Verizon, T-Mobile, and US Cellular after finding that the carriers exaggerated their 4G coverage in official filings. But Pai is moving ahead with plans to require more accurate maps as mandated by Congress.

AT&T and T-Mobile complain about testing cost

AT&T objected to the proposed drive-testing requirement in a filing to the FCC on Tuesday this week, saying that annual “drive testing is not the proper solution for verifying nationwide coverage maps” and that there is “potential difficulty in determining how to formulate a statistically valid sample for areas given the terrain variability nationwide.”

AT&T complained about costs while further explaining its position:

With respect to cost, AT&T estimates that to drive test just 25 percent of the square kilometers of its nationwide 4G LTE coverage would cost approximately $45 million each year and that drive testing only 10 percent of its coverage would still cost as much as $18 million/year. Requiring that all carriers conduct such nationwide drive tests, especially on a regular basis, is simply too costly especially at a time when investment in 5G deployment is a top national priority. The [FCC order] proposes to use a statistically valid sample where carriers would be expected to conduct a certain amount of drive tests “that is statistically appropriate for the area tested.” However, there is no indication of how an “area” would be defined, which makes it difficult to assess the feasibility of developing a sample.

Instead of drive testing, AT&T suggested that the FCC could “collect certain confidential tower site location information, which would be a better verification tool compared to drive testing.”

T-Mobile raised similar objections in a filing submitted Monday:

[T]he Commission should not require providers to conduct regular on-the-ground testing. The Commission has considered and rejected similar requirements several times in the past, for the simple reason that on-the-ground testing at scale is “highly complex, time-consuming, and expensive.” Drive tests and similar procedures are extremely expensive and burdensome to conduct, especially at the scale needed for a statistically significant sample of a nationwide network. A blanket requirement to perform regular on-the-ground testing will force providers to spend millions of dollars each year on tests, resources that would be better spent investing in our network and deployment in rural America.

Verizon had objected to the possibility of a nationwide drive-test requirement in a September 2019 filing, saying that “Verizon conducts drive tests in a more targeted manner to calibrate its propagation model and to confirm the accuracy of the model.” With the FCC deciding to require only a statistically significant sample, Verizon’s more recent filings either didn’t mention drive testing or merely sought clarification on the FCC drive-test plan.

Calif. agency pushes for drive testing

Extensive drive testing is supported by the California Public Utilities Commission, which told the FCC in February that “the data and mapping outputs of propagation-based models will not result in accurate representation of actual wireless coverage.” The CPUC said that, based on its experience, “drive tests are required to capture fully accurate data for mobile wireless service areas.”

In another filing in September 2019, the CPUC included a graphic showing how the agency’s own drive tests in California revealed that the map submitted by one unnamed national carrier dramatically overstated coverage:

“We have found such overstatement of [mobile] providers’ submitted coverage footprints to be the case for all providers in all years we conducted tests, not just for the anonymized single example shown above,” the CPUC told the FCC. “Inaccurate data resulting from propagation modeling will have serious impacts on infrastructure grant programs aimed at eliminating the digital divide. We have no reason to believe that the technical and statistical parameters for propagation modeling on which the [FCC] seeks comments will produce more accurate propagation results.”

A Vermont state official conducted speed tests while driving more than 6,000 miles in the fall of 2018, and found “wide disparities” between actual coverage and the coverage reported by carriers.

The FCC said its tentative plan for carrier-submitted speed tests would at a minimum require “that the speed tests include downlink, uplink, latency, and signal strength measurements and that they be performed using an end-user application that measures performance between the mobile device and specified test servers.” The FCC also proposed “that speed tests must be taken outdoors” and in a “combination of mobile and stationary tests to accurately verify the coverage speed maps.”

The FCC could change its plan after evaluating comments, and it said it would use input from the public to help develop a methodology that carriers would have to follow in testing. Among other things, the FCC’s request for comments said it is trying to determine how the tests should be distributed between urban and rural areas, how to “ensure that the speed test measurements represent the typical user case for the area covered,” and how to “prevent providers from performing their tests close to their towers where signal strength is greatest.” The FCC is also considering whether to “specify the types of equipment that providers can use, including the handsets and any other special equipment necessary for the testing.”

Last year, AT&T and other carriers tried to convince the FCC to avoid requiring 5G maps. But the FCC’s current plan proposes requiring submission of 5G maps in addition to maps of 3G and 4G networks.

https://arstechnica.com/?p=1700218

Law enforcement in several cities, including New York and Miami, have reportedly been using controversial facial recognition software to track down and arrest individuals who allegedly participated in criminal activity during Black Lives Matter protests months after the fact.

Miami police used Clearview AI to identify and arrest a woman for allegedly throwing a rock at a police officer during a May protest, local NBC affiliate WTVJ reported this week. The agency has a policy against using facial recognition technology to surveil people exercising “constitutionally protected activities” such as protesting, according to the report.

“If someone is peacefully protesting and not committing a crime, we cannot use it against them,” Miami Police Assistant Chief Armando Aguilar told NBC6. But, Aguilar added, “We have used the technology to identify violent protesters who assaulted police officers, who damaged police property, who set property on fire. We have made several arrests in those cases, and more arrests are coming in the near future.”

An attorney representing the woman said he had no idea how police identified his client until contacted by reporters. “We don’t know where they got the image,” he told NBC6. “So how or where they got her image from begs other privacy rights. Did they dig through her social media? How did they get access to her social media?”

Similar reports have surfaced from around the country in recent weeks. Police in Columbia, South Carolina, and the surrounding county likewise used facial recognition, though from a different vendor, to arrest several protesters after the fact, according to local paper The State. Investigators in Philadelphia also used facial recognition software, from a third vendor, to identify protestors from photos posted to Instagram, The Philadelphia Inquirer reported.

New York City Mayor Bill de Blasio promised on Monday the NYPD would be “very careful and very limited with our use of anything involving facial recognition,” Gothamist reported. This statement came on the heels of an incident earlier this month when “dozens of NYPD officers—accompanied by police dogs, drones and helicopters” descended on the apartment of a Manhattan activist who was identified by an “artificial intelligence tool” as a person who allegedly used a megaphone to shout into an officer’s ear during a protest in June.

Unclear view

The ongoing nationwide protests, which seek to bring attention to systemic racial disparities in policing, have drawn more attention to the use of facial recognition systems by police in general.

Repeated tests and studies have shown that most facial recognition algorithms in use today are significantly more likely to generate false positives or other errors when trying to match images featuring people of color. Late last year, the National Institute of Standards and Technology (NIST) published research finding that facial recognition systems it tested had the highest accuracy when identifying white men but were 10 to 100 times more likely to make mistakes with Black, Asian, or Native American faces.

There’s another, particularly 2020 wrinkle thrown in when it comes to matching photos of civil rights protesters, too: NIST found in July that most facial recognition algorithms perform significantly more poorly when matching masked faces. A significant percentage of the millions of people who have shown up for marches, rallies, and demonstrations around the country this summer have worn masks to mitigate against the risk of COVID-19 transmission in large crowds.

The ACLU in June filed a complaint against the Detroit police, alleging the department arrested the wrong man based on a flawed, incomplete match provided by facial recognition software. In the wake of the ACLU’s complaint, Detroit Police Chief James Craig admitted that the software his agency uses misidentifies suspects 96 percent of the time.

IBM walked away from the facial recognition business in June. The company also asked Congress to pass laws requiring vendors and users to test their systems for racial bias and have such tests audited and reported. Amazon echoed the call for Congress to pass a law while asking police to take a year off from using its Rekognition product in the hope that Congress acts by next summer.

Clearview in particular—used in Miami—is highly controversial for reasons beyond the potential for bias. A New York Times report from January found that the highly secretive startup was scraping basically the whole Internet for images to populate its database of faces. Facebook, YouTube, Twitter, Microsoft, and other firms nearly all sent Clearview orders to stop within days of the report becoming public, but the company still boasts it has around 3 billion images on hand for partners (mostly but not exclusively law enforcement) to match individuals’ pictures against.

The company is facing several lawsuits from states and the ACLU, while individuals are seeking class-action status.

https://arstechnica.com/?p=1699988

The sister of a Saudi dissident has told Bloomberg that a 2015 breach by two Twitter employees enabled the Saudi government to unmask several anonymous Twitter accounts whose tweets criticized the regime. The US federal government criminally charged the two rogue employees last November.

Abdulrahman al-Sadhan is a US-educated Saudi man who worked for the Red Crescent Movement—the Muslim world’s counterpart to the Red Cross. He also secretly ran a popular pseudonymous Twitter account with thousands of followers. The account criticized the Saudi government.

“It is clear this was a targeted attack on purpose on activists and critics on Twitter,” said Areej al-Sadhan, Abdulrahman’s sister. “My brother, unfortunately, is one of those who was targeted.

According to Bloomberg, al-Sadhan was working in his office in Riyadh in 2018 when Saudi Arabia’s secret police took him into custody. His family hasn’t seen him since. They feared he was dead for almost two years until he was allowed to make a phone call in February.

The rogue Twitter employees allegedly accessed confidential information on at least 6,000 Twitter accounts on behalf of the Saudi government. Human rights advocates believe the hacks enabled the Saudi authorities to arrest at least five people who ran pseudonymous Twitter accounts critical of the regime.

“Saudi Arabia is spending millions of dollars on digital espionage and hacking the accounts of human rights defenders, critics, and opponents,” said Gamal Eid, executive director of the Egypt-based Arabic Network for Human Rights Information.

The Saudi government has long warned Saudis against trying to use anonymity as a shield when they criticize the government, as Bloomberg explains:

In August 2017, one of Saudi Crown Prince Mohammed Bin Salman’s then-closest advisers, Saud al-Qahtani, issued a warning through his own verified Twitter account against anonymous Twitter accounts: “Does a pseudonym protect you from the #blacklist?” al-Qahtani wrote. “No.”

Al-Qahtani explained that governments could find out the real identities of people using Twitter anonymously. He mentioned “technical ways” of tracing people’s IP addresses, as well as a “secret I’m not going to say.”

Al-Qahtani has since been suspended from Twitter; he lost his government post in the wake of the 2018 murder of journalist Jamal Khashoggi.

The Saudis have been accused of targeting people outside of Saudi Arabia as well. Dissidents in the US and Canada have sued Twitter over the 2015 breach, arguing that they should have been warned about the Saudis targeting their accounts. In an unrelated incident last year, Amazon CEO Jeff Bezos accused the Saudi government of hacking into his phone and obtaining racy photos that wound up in the hands of the National Enquirer.

https://arstechnica.com/?p=1699984

Ransomware operators are continuing their blitz on corporations with deep pockets, with Jack Daniel’s distiller Brown-Forman and cruise line behemoth Carnival being two of the latest to be hit.

In a statement, Brown-Forman officials wrote:

Brown-Forman was the victim of a cybersecurity attack. Our quick actions upon discovering the attack prevented our systems from being encrypted. Unfortunately, we believe some information, including employee data, was impacted. We are working closely with law enforcement, as well as world class third-party data security experts, to mitigate and resolve this situation as soon as possible. There are no active negotiations.

The statement came after Bloomberg News reported that it had received an anonymous tip of a ransomware attack. A Dark Web site that claims to be run by members of the REvil strain of ransomware says it has obtained 1 terabyte of data from Louisville, Kentucky-based Brown-Forman. (In addition to producing Jack Daniel’s, Brown-Forman also owns Finlandia vodka and other spirits.)

The site, which Ars isn’t linking to, said that stolen data included contracts, financial statements, credit histories, and internal correspondence of employees. Also included were screenshots of file structures and documents purportedly taken during the heist.

Ars was unable to confirm the authenticity of the data. The Brown-Forman statement didn’t comment on the Dark Web site claims or the purported evidence. A Brown-Forman spokeswoman didn’t answer questions posed by Ars.

Meanwhile, the world’s biggest cruise operator, Carnival Corporation, reported on Monday that it was hit by a ransomware attack that provided unauthorized access to personal data of passengers and employees. Company officials learned of the infection on Friday, but when the infection started or how long it lasted before it was caught remain unclear.

The company didn’t identify the ransomware strain or say if data is already circulating. Company officials have also yet to identify which of its numerous subsidiary cruise lines was breached. Carnival disclosed the attack in a regulatory filing with the Securities and Exchange Commission. Part of the filing read:

Based on its preliminary assessment and on the information currently known (in particular, that the incident occurred in a portion of a brand’s information technology systems), the Company does not believe the incident will have a material impact on its business, operations or financial results. Nonetheless, we expect that the security event included unauthorized access to personal data of guests and employees, which may result in potential claims from guests, employees, shareholders, or regulatory agencies. Although we believe that no other information technology systems of the other Company’s brands have been impacted by this incident based upon our investigation to date, there can be no assurance that other information technology systems of the other Company’s brands will not be adversely affected.

Ransomware has emerged as one of the key forms of attack by financially motivated hacking groups. After initially gaining access, members often spend days or weeks mapping machine topology and obtaining passwords in an attempt to maximize the damage that can be done. To add a new line of revenue, many ransomware groups in recent months have begun selling the confidential data they steal. Payments are made through bitcoin and occasionally other types of digital coin.

A recent ransomware attack on GPS device and services provider Garmin cause outages that shut down many of its services for more than four days. There were no reports of outages affecting either Brown-Forman or Carnival. https://arstechnica.com/?p=1699855

A notorious anti-vaccine group spearheaded by Robert F. Kennedy Jr. filed suit today in federal court in California alleging that Facebook’s fact-checking program for false scientific or medical misinformation violates its constitutional rights.

Children’s Health Defense claims in its suit (PDF) that Facebook, its CEO Mark Zuckerberg, and the organizations Science Feedback, Poynter, and PolitiFact acted “jointly or in concert with federal government agencies” to infringe on CHD’s First and Fifth Amendment rights. The suit also alleges Facebook and the fact-checking organizations colluded to commit wire fraud by “clearing the field” of anti-vaccine ads.

Facebook has “insidious conflicts with the pharmaceutical industry and its captive health agencies,” CHD claimed in a press release. “Facebook currently censors Children’s Health Defense’s page, targeting its purge against factual information about vaccines, 5G and public health agencies.”

“This is an important First Amendment case testing the boundaries of government authority to openly censor unwanted critiques of government policies and pharmaceutical and telecom products on privately owned internet platforms,” Kennedy added in a written statement.

Facebook’s biggest anti-vaxxer

Kennedy, through CHD and an affiliated group called the World Mercury Project, was responsible for more than half of anti-vaccine advertisements on Facebook when they were permitted, researchers found last year. That ended in 2019 amid a measles outbreak, when Facebook updated its policies following pressure from the Centers for Disease Control and lawmakers.

Ads touting false claims about vaccines were banned, and pages and groups that promote vaccine misinformation or hoaxes have their content deprecated in search and recommendations. Posts about vaccines may also be subject to Facebook’s fact-checking process and potentially have a link appended to lead readers to informative sites such as the World Health Organization.

Facebook’s fact-checking actions both violate CHD’s rights and also are defamatory, the group alleges. The organization’s reputation “depends on the credibility of its science-based research articles,” CHD writes in the suit, “which explore both the known and presently-unknown public health risks of vaccines and 5G and wireless technology.”

Essentially, the 115-page complaint argues that Facebook’s actions amount to censorship and defamation because CHD doesn’t like having its content called out as misinformation.

Facebook “integrated WHO and CDC definitions of ‘vaccine hoax’ into the algorithms and machine learning by which they have identified CHD’s content, which is often flagged merely because it is critical of those same agencies as ‘biased,’ ‘unreliable,’ and ‘out-of-date,'” the suit complains, adding that Facebook and the fact-checkers colluded “to label [CHD’s content] ‘False’ when it is critical of vaccine or 5G network safety, accomplishing this censorship through the sham machinations of ‘content moderators’ and ‘independent fact-checkers.'”

Working as intended

These actions “have already injured” CHD, the suit claims, “and will have the effect of further injuring [CHD] by damaging its trade reputation and goodwill, and those of [its] authors, diverting traffic from its site, and further curtailing its revenue and donations.”

If Facebook’s actions did indeed deprecate CHD’s anti-vaccine content and divert attention away, as the suit alleges, then its systems are working exactly as intended. But CHD cited a strong ally in its suit against those systems: the White House.

In May, President Donald Trump signed an executive order on “preventing online censorship.” That order, while arguably utterly unenforceable, calls on regulators to prevent social media firms, including Facebook, from working “to stifle viewpoints with which they disagree.”

There’s only so much one can “disagree” with facts; the Earth remains round (and its climate is changing) whether or not you believe it is. Historically, however, Facebook has had a very hard time walking that line and separating “fact” from “opinion” in its fact-checking process—particularly when someone with an audience cries “bias.”

In July, for example, reporters found that Facebook categorized climate change denialism, based on false claims, as “opinion” and exempted it from the fact-check process even though staff agreed it was partly false.

CHD in the suit argued that its anti-vaccine content should also be treated as opinion much as climate-change denialism is. “By using Facebook’s pre-populated options to mislabel [CHD’s] articles and videos, Science Feedback and Facebook intentionally tell the public that Plaintiff is presenting false information, when they know that the information presented is, at most, opinion and not false fact,” CHD claimed.

https://arstechnica.com/?p=1699719

The Federal Communications Commission is taking another round of public comments on Charter’s petition seeking permission to impose data caps on broadband users and charge network-interconnection fees to online-video providers, following a court ruling that may complicate the FCC’s decision.

The deadline for comments on Charter’s petition passed on August 6. But in a public notice issued today, the FCC said it is opening an additional comment period that will last until September 2, giving people time to weigh in on the impact of the court ruling.

“To ensure that the [Wireline Competition] Bureau has a full record upon which to evaluate the effects of the conditions, we initiate this additional comment period,” the FCC notice said, while also inviting commenters to “address the effect” of the new court ruling on the FCC’s consideration of Charter’s petition. As before, comments can be submitted on the docket by clicking “New Filing” or “Express.” There are more than 1,500 filings, mostly from consumers who object to data caps.

Court ruling lets Charter charge new fees

The ruling Friday by the US Court of Appeals for the District of Columbia Circuit eliminated a merger condition that required Charter to provide free network interconnection to large online providers until May 18, 2023. The Obama-era FCC imposed that and other conditions on Charter when it bought Time Warner Cable and Bright House Networks in 2016 with the goal of preventing business disputes that have a history of harming consumer-broadband performance when companies refuse to pay fees demanded by ISPs. But the Trump-era FCC under Chairman Ajit Pai chose not to defend the merits of the merger conditions in court, paving the way for the new ruling.

The ruling came two months after Charter petitioned the FCC to let the merger conditions banning data caps and network-interconnection payments expire two years early, in May 2021. That’s the earliest date on which the conditions can be eliminated under the original terms of the merger approval. Friday’s court ruling seems to render Charter’s petition moot as far as the network-interconnection condition goes, but the FCC still has to at least decide whether to lift the data-cap prohibition.

Pai voted against the merger conditions when he was a commissioner but not yet the chairman, and now he has a chance to let Charter off the hook two years early. Even with the extra comment period, the FCC has plenty of time before the proposed May 2021 expiration date. Pai would likely try to push through a ruling on Charter’s petition by the end of this year because a potential Joe Biden victory in the presidential election would give Democrats the FCC majority as early as January.

Charter is the second-biggest cable company in the United States after Comcast, and it offers service in 41 states under the Spectrum brand name. Charter has said it doesn’t “currently” plan to impose data caps or charge for interconnection, but the company recently tried to convince the FCC in a filing that home-Internet plans with data caps are “often popular” with broadband users.

In a filing on Friday, Charter confirmed that it has complied with the network-interconnection requirement. But with the court having vacated that merger condition, Charter could theoretically start asking online-video providers for payments even before the FCC issues its decision. Charter did not respond to a request for comment after Friday’s court ruling.

Disclosure: The Advance/Newhouse Partnership, which owns 13 percent of Charter, is part of Advance Publications. Advance Publications owns Condé Nast, which owns Ars Technica.

https://arstechnica.com/?p=1699831