A critical bug that has lurked in iPhones and iPads for eight years appears to be under active attack by sophisticated hackers to hack the devices of high-profile targets, a security firm reported on Wednesday.

The exploit is triggered by sending booby-trapped emails that, in some cases, require no interaction at all and, in other cases, require only that a user open the message, researchers from ZecOps said in a post. The malicious emails allow attackers to run code in the context of the default mail apps, which make it possible to read, modify, or delete messages. The researchers suspect the attackers are combining the zero-day with a separate exploit that gives full control over the device. The vulnerability dates back to iOS 6 released in 2012. Attackers have been exploiting the bug since 2018 and possibly earlier.

Enormous scope

“With very limited data we were able to see that at least six organizations were impacted by this vulnerability— and the full scope of abuse of this vulnerability is enormous,” ZecOps researchers wrote. “We are confident that a patch must be provided for such issues with public triggers ASAP.”

Targets from the six organizations include:

• Individuals from a Fortune 500 organization in North America
• An executive from a carrier in Japan
• A VIP from Germany
• Managed security services providers in Saudi Arabia and Israel
• A journalist in Europe
• Suspected: An executive from a Swiss enterprise

Zerodays, or vulnerabilities that are known to attackers but not the manufacturer or the general public, are rarely exploited in the wild against against users of iPhones and iPads. Some of the only known incidents a 2016 attack that installed spyware on the phone of a dissident in the United Arab Emirates, a WhatsApp exploit in May of last year that was transmitted with a simple phone call, and attacks that Google disclosed last August.

Apple has currently patched the flaw in the beta for iOS 13.4.5. At the time this post went live, a fix in the general release had not yet been released.

Malicious mails that trigger the flaw work by consuming device memory and then exploiting a heap overflow, which is a type of buffer overflow that exploits an allocation flaw in memory reserved for dynamic operations. By filling the heap with junk data, the exploit is able to inject malicious code that then gets executed. The code triggers strings that include 4141…41, which are commonly used by exploit developers. The researchers believe the exploit then deletes the mail.

A protection known as address space layout randomization prevents attackers from knowing the memory location of this code and thus executing in a way that takes control of the device. As a result, the device or application merely crashes. To overcome this security measure, attackers must exploit a separate bug that reveals the hidden memory location.

Little or no sign of attack

The malicious mails need not be prohibitively large. Normal-size emails can consume enough RAM using rich text format documents, multi-part content, or other methods. Other than a temporary device slowdown, targets running iOS 13 aren’t likely to notice any signs that they’re under attack. In the event that the exploit fails on a device running iOS 12, meanwhile, the device will show a message that says “This message has no content.”

ZecOps said the attacks are narrowly targeted but provided only limited clues about the hackers carrying them out or targets who were on the receiving end.

“We believe that these attacks are correlative with at least one nation-state threat operator or a nation-state that purchased the exploit from a third-party researcher in a Proof of Concept (POC) grade and used ‘as-is’ or with minor modifications (hence the 4141..41 strings),” ZecOps researchers wrote. “While ZecOps refrain from attributing these attacks to a specific threat actor, we are aware that at least one ‘hackers-for-hire’ organization is selling exploits using vulnerabilities that leverage email addresses as a main identifier.”

The most visible third-party organization selling advanced smartphone exploits is Israel-based NSO Group, whose iOS and Android exploits over the past year have been found being used against activists, Facebook users, and undisclosed targets. NSO Group has come under sharp criticism for selling its wares in countries with poor human-rights records. In recent months, the company has vowed to serve only organizations with better track records.

It’s generally against security community norms to disclose vulnerabilities without giving manufacturers time to release security patches. ZecOps said it released its research ahead of a general release fix because the zeroday alone isn’t enough to infect phones, the bugs had already been mentioned in the beta release, and the urgency created by the six organizations the firm believes are under active attack

To prevent attacks until Apple releases a general-availability patch, users can either install the beta 13.4.5 or use an alternate email app such as Gmail or Outlook. Apple representatives didn’t respond to an email seeking comment for this post.

https://arstechnica.com/?p=1670281

More than 230 Charter employees have tested positive for COVID-19, and at least two have died, The New York Times reported today.

New York Attorney General Letitia James’ office has opened an inquiry into Charter’s labor practices and management of employees during the pandemic, a spokesperson for James confirmed to Ars today.

Charter has faced numerous complaints from employees about the company’s refusal to let them work from home during the pandemic. The cable company partially backed away from its strict rules on March 20, saying it would let up to 40 percent of call-center employees do remote work. But Charter’s slow reaction to the pandemic—while the similarly situated Comcast moved aggressively to get employees into work-at-home situations—may have contributed to the spread of coronavirus in the company.

“Of the [Charter] Spectrum employees who tested positive for COVID-19, roughly half worked in offices or call centers… at least two Spectrum field workers have died,” the Times reported, citing an anonymous source.

“Any worker who has tested positive for COVID-19 is given two weeks of paid sick leave,” a Charter spokesperson said, according to the Times. Charter has 95,000 employees in 41 states, including about 40,000 in call centers and offices, and 55,000 who “deal with customers face to face as field technicians or retail employees,” the Times wrote.

Charter has apparently expanded work-at-home rights since its March 20 announcement. A Charter spokesperson told Ars today that “the significant majority of our office and call-center employees are working from home.” Charter declined to provide details on the number of illnesses and deaths from COVID-19 at the company, and it declined to comment on the New York attorney general’s inquiry.

“Breeding ground for germs”

Charter CEO Tom Rutledge angered employees last month when he issued a memo telling them to keep coming to the office even if their jobs can be performed from home, because people “are more effective from the office.” In mid-March, we talked to several Charter employees who complained that they should be able to work at home instead of in call centers; one employee described a call center as “an absolute nightmare breeding ground for germs.” Several Charter office buildings were shut down temporarily to be disinfected after employees got sick. Charter also faced criticism last month for giving its cable technicians $25 restaurant gift cards instead of hazard pay for going into customer homes during the pandemic.

Charter yesterday announced that it won’t do any layoffs or furloughs “for at least the next 60 days.” Other previously announced concessions to workers included pay increases “for all hourly workers from $15 to $20 over the next two years with an immediate increase of $1.50 an hour for the frontline field and customer operations employees and an additional $1.50 starting March 2021.” Charter is also offering “three weeks of COVID-19-related flex time” and upgraded health plans “to waive costs for diagnostic testing services and telehealth visits for 90 days.”

“Employees may take those [three weeks of flex time] off, though salaried workers have been encouraged to use that time to work remotely,” the Times wrote.

A month-old petition on Change.org urging Rutledge to let more employees work remotely has received about 7,800 signatures. “There are a lot of us who are in the high-risk group due to old age and you are putting us and our families at risk of getting exposed to this virus,” the petition said.

https://arstechnica.com/?p=1669944

The Federal Communications Commission is in another dispute with the fire department that fought for net neutrality rules after being throttled by Verizon during a wildfire response.

The Santa Clara County Central Fire Protection District, along with the cities of Los Angeles and New York, last week asked the FCC to extend a deadline for filing comments on the last remaining piece of FCC Chairman Ajit Pai’s net neutrality repeal. Pai had to seek another round of public comments on the net neutrality repeal and related deregulation of the broadband industry because federal judges who upheld the overall repeal ruled that Pai “failed to examine the implications of its decisions for public safety.”

The fire department and cities said they couldn’t meet the FCC’s comments deadline because of the coronavirus pandemic. But the FCC refused to grant more time for filing comments in an order issued yesterday, resulting in condemnation from the Santa Clara County Fire Department, Democrats, and consumer advocates.

“When the Trump FCC repealed net neutrality two years ago, it completely ignored public safety,” US Rep. Anna Eshoo (D-Calif.) said. “Santa Clara County firefighters paid a steep price when Verizon throttled their data speeds as they fought the worst fire in California’s history, and the County was helpless to resolve the issue… Now, when these same first responders of the Santa Clara County Fire Department are requesting a very reasonable extension to file their comments in the FCC’s order because they are on the front lines in responding to the worst pandemic of our lifetimes, Chairman Pai has ignored their pleas. The FCC’s decision is shameful, offensive, and dangerous. The FCC must rethink this decision immediately.”

Santa Clara, the FCC, and net neutrality

If your memory of the Santa Clara controversy is vague, here’s a refresher on what happened and what it has to do with the FCC’s net neutrality repeal.

In August 2018, the fire department said its “unlimited” data service was throttled by Verizon Wireless while it was fighting the Mendocino Complex Fire, making it harder to coordinate the response. This was shortly after Pai’s repeal of net neutrality rules took effect.

The net neutrality rule that banned throttling likely wouldn’t have directly outlawed this type of data slowdown, which had to do with limits on the plan selected by the fire department and what Verizon called a “customer service mistake” that resulted in the carrier failing to follow its own policy of “remov[ing] data speed restrictions when contacted in emergency situations.” But Pai achieved his net neutrality repeal by eliminating Title II regulation of broadband, which gave the FCC more power over Internet providers and allowed Internet users to file complaints about any unjust or unreasonable prices and practices. Theoretically, an FCC chairman who was interested in regulating broadband could have used Title II authority to ensure that public-safety agencies are protected from throttling during emergencies.

Santa Clara County Fire Chief Anthony Bowden detailed his department’s experience as part of a multi-state lawsuit that sought to reinstate net neutrality rules and Title II broadband regulation. Though federal appeals court judges didn’t block the repeal, they ruled that the “commission’s disregard of its duty to analyze the impact of the 2018 Order on public safety renders its decision arbitrary and capricious in that part and warrants a remand with direction to address the issues raised.”

To comply with that order, the FCC on February 19 asked for public comment “on how the changes adopted in the Restoring Internet Freedom Order might affect public safety.”

Pandemic delayed response to FCC

The FCC set a comment deadline of March 30, but on March 25, it granted a request from Santa Clara and others for an extension, making the new deadline April 20. (The petitioners asked for a 30-day extension; the FCC gave them 21 days instead.)

On April 16, Santa Clara, Los Angeles, and New York requested another extension, this time for 60 days:

While we appreciated [the 21-day] extension, circumstances have not improved since our initial request was submitted. To the contrary, after our March 11 extension request, jurisdictions around the country—including in the Cities of Los Angeles and New York and [Santa Clara] County—have ordered residents to shelter in place, and many essential public safety and public health officials are working around the clock to protect residents from the novel coronavirus pandemic. Indeed, New York City is the current epicenter of the COVID-19 pandemic. For these reasons, a further extension is necessary to ensure that the refreshed record is complete.

Government personnel “including emergency operations staff and centers” are “fully occupied” by the response to the emergency and “cannot be diverted from their critical operations,” they said. That prevents municipalities from offering a thorough response to the FCC, they wrote, because “the input of our emergency and public safety personnel is critical to an accurate record in these matters as well as the commission’s meaningful consideration of public safety issues.”

The FCC was not swayed. The commission’s denial of the deadline-extension request said that its rules require motions for deadline extensions to “be filed at least seven days before the filing date,” but the extension request came four days before the deadline. The FCC continued:

While requestors note that there is an ongoing emergency, they have not established that the pandemic affected their ability to file a timely motion for extension of time. It is not plausible that requestors first became aware of their purported need for additional time less than seven days before the deadline for initial comments on April 20. It would be unfair at this late date to extend the comment deadline when other commenters (including, presumably, other states and localities) have been preparing to submit timely filings.

The FCC noted that it has provided “more than two months to submit comments.”

“As requestors recognize, the issues in this proceeding have public safety implications, and we do not believe that delaying resolution of these critical issues is in the public interest,” the FCC also said.

FCC faces blowback

Santa Clara County Counsel James Williams decried what he called “the absurdity of the FCC denying the County’s request for an extension to submit these comments in the midst of the pandemic response.”

“The FCC’s assertion is that the issue has public safety implications that must be decided without further delay,” Williams said. “The FCC lost on this issue [in court] precisely because it did not fully consider the repeal’s threats to public safety, and now it is attempting to cook the books by manipulating the timing of public comments in the middle of a pandemic that local public servants—our front-line defenders—are heroically battling. They cannot be diverted from their critical operations yet are essential to a full and accurate response to the FCC’s query.”

Jessica Rosenworcel, one of two Democrats on the Republican-majority FCC, said it is “shameful that the FCC did not heed” the municipalities’ request for more time. “The FCC was wrong when it repealed net neutrality and was wrong again today in its decision to deny a request from cities and first responders seeking extra time to comment on the net neutrality remand,” Rosenworcel said yesterday. “We are in the middle of an unprecedented nationwide crisis. Understandably, local governments and public safety officials have asked for more time to comment so that they rightfully can focus on responding to the public health emergency at hand.”

New America’s Open Technology Institute and Common Cause, two consumer-advocacy groups, also criticized the FCC for refusing the extension request. “The commission has an obligation to ensure robust participation of public safety voices in this proceeding,” the groups said in a filing. “The court admonished the commission for ignoring public safety and specifically cited the commission’s disregard of concerns raised by Santa Clara County, one of the parties that now seeks an extension. The record would be incomplete without their full participation.”

The decision to deny the extension request “is as inexplicable as the FCC’s prior failure in 2017 even to consider the needs of public safety in holding that broadband is not a ‘telecommunications service’ under Title II of the Communications Act,” Benton Institute Senior Counselor Andrew Schwartzman said.

Schwartzman, who represented the Benton Institute and Consumer Reports in the lawsuit that unsuccessfully sought to reinstate net neutrality rules, said that the FCC’s latest decision could cause it further problems in court. “There is a reason that the [US] Court of Appeals [for the District of Columbia Circuit] told the commission to address that [public-safety] obligation, and today’s action likely will not be viewed favorably at such time as it goes back to the court,” he said.

https://arstechnica.com/?p=1669882

A federal court has ordered the “Genesis II Church of Health and Healing” to stop distributing a bleach product that Genesis claims is a cure for COVID-19 and many other health problems.

The US government sued Genesis on Thursday, alleging that it violated the Federal Food, Drug, and Cosmetic Act with labeling for its so-called Miracle Mineral Solution (MMS), also known as Master Mineral Solution. Genesis’ website “contains claims that MMS is intended to cure, mitigate, treat, or prevent coronavirus, which includes COVID-19, and links to testimonials claiming that MMS cures a litany of other diseases including, among others, Alzheimer’s, autism, brain cancer, HIV/AIDS, and multiple sclerosis,” the lawsuit said. Despite its name, the “church” is a “secular entity based in the State of Florida,” the government lawsuit said.

“In the midst of a viral pandemic and national emergency like nothing seen for more than a century, the above-captioned defendants are exploiting the crisis by marketing a powerful industrial bleach to consumers as a remedy for coronavirus,” the government also said in its lawsuit.

On Friday, the government’s request for a temporary injunction against Genesis was granted by Judge Kathleen Williams of US District Court for the Southern District of Florida. The injunction orders Genesis to refrain from distributing MMS or any other unapproved drug. The Food and Drug Administration (FDA) said in an announcement:

In granting the government’s request for relief, the court found that the United States has demonstrated that Genesis and the associated individuals named in the injunction are violating the Federal Food, Drug, and Cosmetic Act (FD&C) by unlawfully distributing MMS, an unapproved new drug and misbranded drug. When combined with the included activator MMS has a chlorine dioxide content equivalent to industrial bleach. The court also found that there is a danger that the defendants will continue violating the law without the temporary restraining order.

A preliminary-injunction hearing is scheduled for May 1. While Genesis is currently prevented from selling MMS under the temporary restraining order, the FDA is also seeking a permanent injunction and refunds for people who bought MMS.

“Please pray for us”

Genesis was selling MMS online and describes it as a sacrament. Attempting to purchase the product today leads to an error page that says, “We are currently in prayer!!! During these difficult and trying times, we are in prayer and seeking The LORD’s wisdom & guidance. Please pray for us.”

Genesis’ main website calls the organization “a non-religious church” that aims to “restore health” to the world and which “was formed for the purpose of serving mankind and not for the purpose of worship.”

We contacted Genesis about the FDA lawsuit and injunction today and will update this article if we get a response.

“Despite a previous warning, the Genesis II Church of Healing has continued to actively place consumers at risk by peddling potentially dangerous and unapproved chlorine dioxide products,” FDA Commissioner Stephen Hahn said. “We will not stand for this, and the FDA remains fully committed to taking strong enforcement action against any sellers who place unsuspecting American consumers at risk by offering their unproven products to treat serious diseases.”

In addition to Genesis itself, the named defendants in the lawsuit are Mark Grenon, Joseph Grenon, Jordan Grenon, and Jonathan Grenon. Mark Grenon is described by Genesis as its “archbishop.”

Dangerous, life-threatening side effects

Genesis has been touting its bleach product for years and was called the “Church of bleach” in a KABC-TV report in October 2016. Genesis was founded by Jim Humble, “a former Scientologist who claims he’s a billion-year-old god from the Andromeda galaxy,” and the group pitches MMS as a “‘miracle potion’ [that] can cure anything from cancer to the common cold,” that report noted.

Genesis “disputes that MMS is bleach, noting that it is not the same as the liquid bleach one might buy in a grocery store, which is sodium hypochlorite,” we noted in an August 2019 article. “But ‘bleach’ is actually a generic term used to describe many stain-fighting chemical products, which often are chlorine-based and work by strong oxidation reactions.”

In a Genesis website post on April 4,  Mark Grenon issued an “Official Plea for COVID-19 Testimonies,” saying that Genesis wants to “gather all people young and old that are Positive for COVID-19 who were given MMS and the Activator for treatment” in order to conduct further testing. “Let’s prove to the world that the G2Church Sacraments work to cleanse the body of DISEASE and that Jim Humble made an incredible formula to truly ‘create a world without disease,'” Grenon wrote.

The FDA in August 2019 warned consumers to avoid MMS, saying it has “dangerous and potentially life-threatening side effects.” The FDA at the time said it had “received new reports of people experiencing severe vomiting, severe diarrhea, life-threatening low blood pressure caused by dehydration and acute liver failure after drinking these products.”

After receiving a warning letter from the FDA on April 8, Genesis issued a response claiming that “our Sacraments are not dangerous or life threatening in any way [as] evidenced by the approval by your FDA and EPA in many applications!”

The FDA said last week that it “has not approved Genesis’ product for any use, despite the defendants’ claims that these products can be used to cure, mitigate, treat or prevent diseases such as COVID-19, Alzheimer’s, autism, brain cancer, multiple sclerosis and HIV/AIDS.”

“Don’t try to tell me there is an emergency situation in our nation that justifies this action!” Genesis’ response to the FDA said. “There can’t be an emergency that can make a command of God null and void especially one in regard to the free exercise of our Church!” Genesis also claimed it isn’t selling MMS because it distributes the product in exchange for “donations.”

The FDA said last week that Genesis’ response to the warning letter “made clear that they had no intention of taking corrective action and would continue to sell MMS in violation of the law.”

https://arstechnica.com/?p=1669644

Facebook has nixed event pages for planned protests against stay-at-home measures in California, New Jersey, and Nebraska. The actions come at the request of state officials, who say the gatherings would violate state orders.

Facebook event pages for similar protests in other states remain online.

“Unless government prohibits the event during this time, we allow it to be organized on Facebook. For this same reason, events that defy government’s guidance on social distancing aren’t allowed on Facebook,” a Facebook spokesperson told Politico.

Activists across the country, mostly from the right end of the political spectrum, have begun agitating for an early end to legally mandated social distancing measures. According to The Washington Post, a trio of gun rights activist brothers in Minnesota have created a number of popular groups fighting stay-at-home measures on Facebook, including in Wisconsin, Ohio, Pennsylvania, and New York.

Donald Trump threw his weight behind three state protests on Friday with tweets to “LIBERATE VIRGINIA,” “LIBERATE MICHIGAN,” and “LIBERATE MINNESOTA.”

Despite the protests, polls continue to show broad public support for social distancing efforts. A Wall Street Journal/NBC poll published Sunday found that 58 percent of voters were more worried that lifting restrictions would lead to more COVID-19 deaths than they were about continued stay-at-home orders harming the economy. Democrats overwhelmingly favored continuing restrictions, while Republicans were more evenly split: 48 percent of Republicans worried more about the economy, while 39 percent worried more about the health dangers of premature liberalization.

https://arstechnica.com/?p=1669600

As many as a billion mobile phone owners around the world will be unable to use the smartphone-based system proposed by Apple and Google to track whether they have come into contact with people infected with the coronavirus, industry researchers estimate.

The figure includes many poorer and older people—who are also among the most vulnerable to COVID-19—demonstrating a “digital divide” within a system that the two tech firms have designed to reach the largest possible number of people while also protecting individuals’ privacy.

Apple’s iPhones and devices running on Google’s Android operating system now account for the vast majority of the 3.5 billion smartphones estimated to be in active use globally today. That provides a huge potential network to track infection, with surveys suggesting widespread public support for the idea.

The two rivals are collaborating to develop a contact-tracing system for release as soon as next month.

However, their scheme relies on specific wireless chips and software that are missing from hundreds of millions of smartphones that are still in active use, particularly those that were released more than five years ago.

“The underlying technology limitation is around the fact that there are still some phones in use that won’t have the necessary Bluetooth or latest operating system,” said Ben Wood, analyst at CCS Insight. “If you are in a disadvantaged group and have an old device or a [basic] feature phone, you will miss out on the benefits that this app could potentially offer.”

Public health agencies are being asked to incorporate the Silicon Valley companies’ technology into their own apps, which will notify people if they have come into contact with an infected individual and urge them to self-isolate. The more people who opt in to using the app, the more successful the system will be.

The particular kind of Bluetooth “low energy” chips that are used to detect proximity between devices without running down the phone’s battery are absent from a quarter of smartphones in active use globally today, according to analysts at Counterpoint Research. A further 1.5 billion people still use basic or “feature” phones that do not run iOS or Android at all.

“In all, close to 2 billion [mobile users] will not be benefiting from this initiative globally,” said Neil Shah, analyst at Counterpoint. “And most of these users with the incompatible devices hail from the lower-income segment or from the senior segment which actually are more vulnerable to the virus.”

Smartphone penetration and uptake of particular devices varies widely around the world. In the UK, media regulator Ofcom said last year that about 80 percent of adults own a smartphone. However, Mr. Wood estimates that only around two-thirds of adults would have a compatible phone.

“And that’s the UK, which is an extremely advanced smartphone market,” he said. “In India, you could have 60-70 percent of the population that is ruled out immediately.”

Counterpoint Research is more optimistic, estimating that 88 percent compatibility in developed markets such as the US, UK, and Japan, while about half of people in India would own the necessary handset.

“Apple and Google working together to enable the use of Bluetooth technology to help government agencies identify and arrest the spread of the virus is a step in the right direction,” Shah said.

© 2020 The Financial Times Ltd. All rights reserved. Not to be redistributed, copied, or modified in any way.

https://arstechnica.com/?p=1669609

Update (April 20): The FCC unanimously approved the Ligado network plan on Monday. The order “was adopted without dissent and will promote more efficient and effective use of our nation’s spectrum resources and ensure that adjacent band operations, including the Global Positioning System (GPS), are protected from harmful interference,” the FCC said. As previously reported, the conditions to prevent interference include a 23MHz guard band, a power limit of 9.8dBW, and continuous monitoring of base-station transmit power. The Department of Defense and Department of Transportation continued their opposition on Friday, saying the FCC decision will put GPS users at risk, according to SpaceNews.

Original story (April 16):

The Federal Communications Commission is set to approve a new 5G cellular network despite claims from the Department of Defense that it will interfere with Global Positioning System (GPS) services.

FCC Chairman Ajit Pai today asked fellow commissioners to approve an “application to deploy a low-power terrestrial nationwide network in the L-Band that would primarily support 5G and Internet of Things services.” The application is from Ligado, formerly known as LightSquared, which for nearly a decade has sought permission to build a wireless network using frequencies near those used for GPS. A previous failure to obtain FCC approval helped push LightSquared into bankruptcy.

The FCC said its draft order would “ensure that adjacent band operations, including GPS, are protected from harmful interference.” Pai said the FCC has “compiled an extensive record, which confirms that it is in the public interest to grant Ligado’s application while imposing stringent conditions to prevent harmful interference.” He continued:

Although I appreciate the concerns that have been raised by certain Executive Branch agencies, it is the Commission’s duty to make an independent determination based on sound engineering. And based on the painstaking technical analysis done by our expert staff, I am convinced that the conditions outlined in this draft order would permit Ligado to move forward without causing harmful interference. For example, the draft order would authorize downlink operations at a power level that represents a greater than 99 percent reduction from what Ligado proposed in its 2015 application.

The base-station power reduction is “from 32dBW to 9.8dBW,” and Ligado committed to a 23MHz “guard-band using its own licensed spectrum to further separate its terrestrial base station transmissions from neighboring operation,” the FCC said.

“As such, Ligado is now only seeking terrestrial use of the 1526-1536MHz, 1627.5-1637.5MHz, and 1646.5-1656.5MHz bands. The Order is conditioned to reflect these technical requirements. It also requires Ligado to protect adjacent band incumbents by reporting its base station locations and technical operating parameters to potentially affected government and industry stakeholders prior to commencing operations, continuously monitoring the transmit power of its base station sites, and complying with procedures and actions for responding to credible reports of interference, including rapid shutdown of operations where warranted,” the FCC said.

Ligado plans to use a mix of satellite and terrestrial communications for its network. Instead of competing directly against Verizon, AT&T, and T-Mobile for smartphone customers, Ligado plans to deliver custom private networks for industrial firms, service for Internet of Things devices and unmanned systems, and connectivity for other business and government use cases. Ligado could also supply capacity to the major wireless carriers.

Secretary of Defense objected

Ligado already “reached co-existence agreements with the five major GPS device manufacturers,” resulting in the guard band and other commitments, Ligado said in an FCC filing. To create the guard band, Ligado said it gave up its “terrestrial rights to one-fourth of its licensed spectrum.”

In a November 2019 letter to Pai, US Secretary of Defense Mark Esper said: “there are too many unknowns and the risks are far too great to federal operations to allow Ligado’s proposed system to proceed. All independent and scientifically valid testing and technical data shows the potential for widespread disruption and degradation of GPS services from the proposed Ligado system. This could have a significant negative impact on military operations, both in peacetime and war.”

Pai’s proposal is expected to be adopted by the full commission. Commissioners can submit their votes at any time because the item was put on circulation instead of being scheduled for one of the FCC’s monthly meetings.

Consumer-advocacy group Public Knowledge commended Pai’s action today, saying “the FCC has worked to both protect incumbent GPS users while allowing for pro-competitive commercial licensing of spectrum.” Public Knowledge previously told the FCC that the Department of Defense has raised “repeated objections without new engineering evidence.” By intervening directly in the FCC proceeding, the DOD also violated “the legal requirement that NTIA (National Telecommunications and Information Administration) acts as the coordinator and representative of the Executive Branch on matters relating to federal spectrum use,” Public Knowledge said.

Ligado obviously welcomed Pai’s decision today and said “the FCC’s dedicated staff has repeatedly shown its commitment to science-based, engineering-driven decision making.” Ligado also said its lower mid-band spectrum will be important for deploying 5G across wide distances and to indoor spaces. While 5G can be deployed on any spectrum, the biggest speed gains are provided on millimeter-wave frequencies, which don’t travel as far as lower frequencies and are easily blocked by walls and other obstacles. Low- and mid-band spectrum doesn’t have that problem.

“As Ericsson and Nokia technical studies on our proposed network deployment have shown, the superior propagation characteristics of our spectrum will improve mobile 5G coverage—both outdoor and indoor—and in doing so, accelerate the deployment of 5G networks,” Ligado said. Nokia and Ericsson are partnering with Ligado on technical and commercial plans.

Ligado previously planned a 4G network, but the years-long delay resulted in the switch to 5G.

https://arstechnica.com/?p=1668950

In a move that it had been planning since at least last year, the EPA affirmed the existing rules that limit mercury emissions produced by power plants. But the current EPA is not interested in wasting an opportunity to weaken regulations, so it is also undercutting the economic reasoning that was initially used to justify the regulations. This mixed decision may leave the existing regulations at risk in court, and it will definitely make future regulations more difficult.

Some chemical forms of mercury are potent neurotoxins and are a clear public health risk. Power plants are a major source of emissions in the US, and so they potentially fall under the remit of the Clean Air Act. Attempts to regulate mercury emissions date back to the Clinton Administration, were dropped under Bush, and restored by Obama. A few lawsuits added further complications over the course of this history, but a key one was decided by the Supreme Court, which ruled that the Obama administration had erred by not performing an economic analysis before formulating emissions rules.

The Obama-era EPA went back and redid the rulemaking process, and the result was one of the more costly set of rules in US history. Those costs, however, paled in comparison to the benefits that would come through reduced medical costs and improved public health. Most of those benefits, however, didn’t come from the reduced mercury itself. Instead, the process of removing mercury from exhaust streams would also eliminate a lot of particulate emissions, and their absence drove many of the health benefits.

The rules were put in place during the Obama administration, which was promptly sued. The case was still in the courts when Trump took office, and his EPA asked to withdraw from the case so it could formulate new rules. Meanwhile, with the old rules still in effect, utilities did what was needed in order to comply with them, in many cases passing that cost on to consumers. As a result, many utilities publicly voiced opposition to any attempts to roll back emissions limits. The coal industry, the source of most of the mercury, argued in favor of a rollback.

The new rules, announced yesterday, keep existing emissions limits in place. But how it justifies doing so is likely to generate some controversy.

Not friends with co-benefits

In both the EPA’s original and current estimate, the benefits of reducing mercury are relatively minor—the current estimate places those benefits at about $5 million a year. But the process of removing the mercury from the exhaust stream of a power plant also eliminates many other emissions, most notably particulates. The societal costs of particulates are substantial (although the EPA isn’t entirely convinced of that), so the mercury controls would come with what are called co-benefits. In this case, the co-benefits are substantially larger than the direct benefits, with estimates reaching well over $10 billion annually. This is substantially more than the cost of the pollution controls.

While Clean Air Act regulations do not require that the financial benefits outweigh the costs, having the cost-benefit analysis indicate that they do generally leaves a rule less vulnerable to lawsuits.

The new EPA decision, however, indicates that it has determined that regulatory decisions should not consider co-benefits—at all, for this or any future rules. Only the direct benefits can be considered in performing a cost-benefit analysis.

It’s possible that this decision will leave the existing regulations subject to a lawsuit, as the coal industry would undoubtedly be interested in seeing them overturned. If the regulations are overturned, then it will leave utilities with a lot of unneeded equipment that, in many cases, has already had its costs passed on to consumers. It will certainly leave future tightening of these regulations in doubt, even if further studies identify additional issues associated with mercury.

But the EPA’s action raises questions about the prospects for regulating any pollutant successfully. In many cases, like the emission of chemicals that produce acid rain, pollution controls are designed to handle multiple issues simultaneously. By forcing regulatory actions to consider each separately, the decision more or less guarantees that the economies generated by hardware that provides multiple benefits will never enter into the decisionmaking process. Thus, nearly every economic case for regulation will end up looking worse.

Again, the EPA can choose to act even if the economics of regulation aren’t in its favor. But doing so will likely lead to the regulations being tied up in court, much as the mercury ones have.

https://arstechnica.com/?p=1669270

Public health experts are offering mixed reviews of the Trump Administration’s broad, nonbinding guidelines for states to gradually lift social distancing measures currently in place to slow the pandemic spread of COVID-19.

The guidelines, unveiled Thursday, aim to avoid a second, overwhelming wave of disease by easing restrictions in three progressive phases. Each of those phases is gated, meaning that a set of criteria should be met before a state can enter a specific phase. Those gating criteria include states having two-week-long “downward trajectories” of confirmed COVID-19 cases and reports of infections with symptoms similar to COVID-19. States must also have the hospital capacity to treat all patients without “crisis care” and have a “robust” testing program.

The guidelines further lay out core “preparedness responsibilities” that each state should maintain throughout the phases. This criteria includes the ability to test all symptomatic cases and trace their contacts; to set up sentinel surveillance for asymptomatic cases; to have a sufficient supply chain of personal protective equipment (masks, gloves, gowns, etc) for healthcare workers; and to have plans to protect at-risk workers and members of the public, such as healthcare workers, the elderly in living facilities, and workers and members of the public using mass transit.

The guidelines are not binding and President Trump left open to governors how and when to apply them to their states. This more hands-off approach is a reversal from Trump’s earlier claim that he had “total authority” to override governors and reopen states.

The measured guidelines are also notable for not including any firm timelines or dates. Within recent weeks, Trump pushed for states to reopen by April 12 and—after that date passed—May 1. Public health experts criticized the suggestion, arguing that easing of distancing measures should be driven by data and access to resources to quash flare ups—not artificial deadlines.

Yet, despite the unspecified timing in the guidelines, Trump still suggested that several states could begin reopening quickly—some “literally tomorrow,” he said Thursday. Experts disagreed.

Mixed reviews

Barry Bloom, a distinguished professor of public health at Harvard, offered some praise for the Trump administration’s plan overall. “It is quite a thoughtful plan,” he told reporters in a media call late Thursday night. He commended the plan’s phased nature, the continuation of some distancing measures, and its use of a data-driven timeline rather than hard deadlines.

But, Bloom noted that the plan was vague on many decisions, including the gating. Two week declines in cases is a short period for this disease, given that there can be a two-week lag between an infection and getting test results back.

The plan also doesn’t offer guidance on what to do if a state experiences a resurgence of disease, whether its from undetected spread of disease or from introduction of new cases via travelers. The latter has been a particular issue for many places that have relaxed constraints, such as Hong Kong and Singapore.

Plus, the plan ”assumes that testing will be at a level that at the moment does not exist,” Bloom said. He, like many other experts, have repeatedly noted that the country’s capacity for testing and contact tracing is below what’s needed to adequately detect and stop the spread of disease.

William Hanage, an epidemiologist at Harvard, largely echoed all the sentiments. “There is much to appreciate in this plan, including its stepwise thinking and its thoughtful nature.” But he added, “the glaring problem within it” remains the problem of testing.

Though it’s impossible to say exactly how much testing we should do or be able to do on a daily or weekly basis, Hanage notes that the World Health Organization suggests that country’s aim to do enough testing until only 10 percent or less of tests come back positive. Currently, the US has a 20 percent positive rate overall. This is difficult to interpret, however, because different places have different levels of infection and access to and criteria for testing. For instance, places such as New York and New Jersey are swamped with cases—and positive test results—while others are experiencing more sporadic cases that spur less testing.

“We may have an imperfect picture of the state of the pandemic in different parts of the country because it’s difficult to know if we are measuring actual underlying infections or testing capacity,” Hanage said. It’s difficult to disentangle this, he added, but it’s clear that we need more testing.

Further, we’re also woefully unprepared to do contact tracing, which is crucial to stopping transmission at the beginning or at the end of an outbreak.

When asked if any state should feel confident about entering phase one of the Administration’s plan, Bloom responded “no.” Hanage supplemented the response: “Hell no!”

https://arstechnica.com/?p=1669334

As the Colorado River slowly dwindles, groundwater resources are depleted, and wells are being dug ever deeper, the specter of drought looms in the US—particularly, but not exclusively, in the arid Southwest.

Preparing for gradual changes like these is not sexy or popular. But there is a huge amount of crucial work to be done to mitigate the worst possible outcomes of increasing drought, writes environmental politics researcher Megan Mullin in a paper in Science this week. Fragmented water systems across the country have a litany of critical vulnerabilities that will ensure that the worst effects of water scarcity will hit the most vulnerable people in society the hardest.

Crumbling into dust

The Southwest has experienced an abnormally dry period that started back in 2000—an emerging “megadrought” that is due partly to natural climate cycles and partly to anthropogenic climate change. Higher temperatures “increase moisture demand from the land surface,” writes climate risk researcher Toby Ault in a second Science paper on drought this week, “for the same reason that a sauna will dry out a towel faster than a steam room.” Climate driven changes in the patterns of snow and rainfall can also contribute to drought.

As a result of lower levels in rivers and reservoirs, people have been tapping deeper and deeper wells to access steadily depleting groundwater resources, which are often poor quality—or even unusable—at greater depths.

On top of this, water infrastructure is frequently poor to begin with—and often deteriorating. Drought emergencies are declared regularly in the US, Mullin writes, with water systems sometimes running so dry that it’s “necessary to turn to tanker trucks or even fire hoses to bring water into the community for weeks or months.”

This means that drought is more than a natural disaster in the making: like the coronavirus outbreak raging through the US, it’s a disaster that’s natural in origin but magnified by poor infrastructure and societal fragmentation. There are more than 50,000 water services in the US, 82 percent of which deliver water to fewer than 3,000 people. These small systems face a range of problems, from a lack of funding to smaller staff that don’t have the necessary expertise to manage drought mitigation.

Underfunded water systems are more likely to have drought-exaggerating problems like leaking pipes that waste precious water or emergency lines that have not been maintained. They may also run into financial difficulty if people reduce their water usage because this reduces their revenue streams, Mullin points out. And because society is already spatially segregated along racial and economic lines, the water services in poorer areas are likely to be hit the worst.

Some of the bigger, better-funded water systems are already working hard at preparing for more severe and long-term droughts. But smaller systems aren’t doing the urgent work of gathering data on their current water supply or ramping up their ability to deal with shortages in the future, Mullin writes.

Staving off disaster

One of the most important starting points for building some resilience is gathering data, Mullin argues. We need to know how water systems across the country are financed, what their supply and usage look like, and the state of their infrastructure. Dealing with funding problems and moving away from a system that relies on local funding to prop up water systems is another important step.

But this will be challenging, since elected politicians “benefit more from disaster response than disaster preparation,” she writes. And that’s true of the overarching, slowly moving disaster underlying the drought risk, too. “Cutting CO2 emissions reduces drought risk,” writes Ault. Avoiding “just half a degree” of warming would make a meaningful difference to regional drought risk, he adds—the world would look very different with 2ºC of global average warming compared to 1.5ºC.

Disaster preparation demands allocation of time and resources to an issue that is not yet kicking down the door. But the world is experiencing first hand what it looks like when warnings of a looming disaster have not been heeded—and with “megadrought” swiftly encroaching on North America, drought preparation is crucial.

Science, 2020. DOI: 10.1126/science.aba7353  (About DOIs).

https://arstechnica.com/?p=1669179