The courts have long held that laws can’t be copyrighted. But if the state mixes the text of the law together with supporting information, things get trickier. In Monday oral arguments, the US Supreme Court wrestled with the copyright status of Georgia’s official legal code, which includes annotations written by LexisNexis.

The defendant in the case is Public.Resource.Org (PRO), a non-profit organization that publishes public-domain legal materials. The group obtained Georgia’s official version of state law, known as the Official Code of Georgia Annotated, and published the code on its website. The state of Georgia sued, arguing that while the law itself is in the public domain, the accompanying annotations are copyrighted works that can’t be published by anyone except LexisNexis.

Georgia won at the trial court level, but PRO won at the appeals court level. On Monday, the case reached the US Supreme Court.

During Monday’s oral argument, some justices seemed skeptical of Georgia’s position.

“Why would we allow the official law to be hidden behind a pay wall?” asked Justice Neil Gorsuch.

Georgia’s lawyer countered that the law wasn’t hidden behind a paywall—at least not the legally binding parts. LexisNexis offers a free version of Georgia’s code, sans annotations, on its website.

But that version isn’t the official code. LexisNexis’ terms of service explicitly warns users that it might be inaccurate. The company also prohibits users from scraping the site’s content. If you want to own the latest official version of the state code, you have to pay LexisNexis hundreds of dollars. And if you want to publish your own copy of Georgia’s official code, you’re out of luck.

Blurred lines

You might think that PRO could just publish the un-annotated version of Georgia’s code. The problem, as PRO’s Supreme Court brief pointed out, is that Georgia doesn’t publish an un-annotated version. The annotated version is the only official version.

An obvious solution would be for Georgia and LexisNexis to separate the two works. Georgia could publish an official, un-annotated version of the state code that would be in the public domain. LexisNexis could independently produce and publish an annotated guide to the state code, keep the copyright, and charge customers for it. Indeed, Westlaw produces its own copyrighted annotation of the Georgia state code.

But the state of Georgia argues that the intermingling of statute and annotations is necessary to finance the creation of the annotations in the first place. LexisNexis covers the costs of producing the annotated code, then it recoups its investments by charging for copies of it. If the Supreme Court holds that the Official Code of Georgia Annotated is in the public domain, this business model wouldn’t work any more.

But intermingling copyrighted and public domain works creates headaches for third parties wanting to make use of the code.

https://arstechnica.com/?p=1627091

Four former employees who say Google fired them in retaliation for their efforts to organize co-workers are planning legal action against the company. The workers allege the tech giant violated US labor law.

The employees—Laurence Berland, Paul Duke, Rebecca Rivers, and Sophie Waldman—jointly signed onto an open letter posted today outlining their grievances with their former employer.

“We participated in legally protected labor organizing, fighting to improve workplace conditions for all Google workers,” they write. They also worked to “hold Google accountable for the impact on our workplace of its business decisions, policies, and practices on a range of topics.” Those topics include protesting Google’s work with US immigration enforcement agencies and the Department of Defense and protesting Google’s work with the Chinese government, as well as a massive walkout of 20,000 Google employees last year to protest the company’s handling of sexual harassment allegations against senior executives.

The employees continued:

It’s clear that [Google’s] draconian, pernicious, and unlawful conduct isn’t about us. It’s about trying to stop all workplace organizing. Google wants to send a message to everyone: if you dare to engage in protected labor organizing, you will be punished. They count on the fear, the sadness, and the anger that we are all feeling to stop us all from exercising our rights, and to chill all attempts to hold one of the most powerful organizations in history accountable for its actions.

Their first step will be to file charges of Unfair Labor Practice with the National Labor Relations Board. Federal labor law explicitly prohibits employers from retaliating against employees for organizing inside the workplace, either to form a union or to band together to “improve terms and conditions of employment” without a union, and they claim Google did just that.

Berland, Duke, Rivers, and Waldman are not the first high-visibility Google employees to claim their employer acted in a retaliatory fashion. Two employees who helped organize the 2018 mass walkout, Meredith Whittaker and Claire Stapleton, said earlier this year that they were facing retaliation from their employer, writing that they were facing demotions or reassignments that would have significant impacts on their careers. Stapleton left the company in June, followed by Whittaker’s departure in July.

Google denies that the employees were fired in retaliation for any organizing activity. “We dismissed four individuals who were engaged in intentional and often repeated violations of our longstanding data security policies, including systematically accessing and disseminating other employees’ materials and work,” a company spokesperson said in a statement. “No one has been dismissed for raising concerns or debating the company’s activities.”

https://arstechnica.com/?p=1627001

T-Mobile today announced that it has launched “America’s first nationwide 5G network,” but T-Mobile’s definition of “nationwide” doesn’t include about 40% of the US population.

“America gets its first nationwide 5G network today, covering more than 200 million people and more than 1 million square miles,” T-Mobile’s announcement said.

The US Census Bureau estimates the population to be more than 330 million people. T-Mobile hasn’t actually forgotten about the other 130 million people in the US, as a sentence halfway through the carrier’s press release notes that “T-Mobile’s network covers more than 60 percent of the population.” At 1 million square miles, the carrier’s 5G network also covers about 28% of the country’s 3.53 million square miles, and it’s far short of the geographical reach already provided by T-Mobile’s 4G network.

We asked T-Mobile to explain why it defines “nationwide” as “60 percent of the population.” T-Mobile did not answer that question.

T-Mobile’s 4G LTE network covers more than 325 million people.

US coverage map is mostly 4G

T-Mobile said its 5G network today reaches “more than 5,000 cities and towns all across the country,” and the company published a list of those places. There are 19,495 incorporated places in the US.

Despite its actual coverage, T-Mobile’s announcement uses the word “nationwide” to describe the current reach of its 5G network a dozen times while admitting that “coverage [is] not available in some areas.” In the coverage map provided by T-Mobile, which is at the top of this article, you can see that the 5G areas displayed in a darker shade of pink don’t include huge portions of the country covered by T-Mobile 4G. Alaska is excluded entirely.

T-Mobile CEO John Legere today posted a tweet announcing the “first nationwide 5G” network and a video in which he says that “nationwide 5G is live.” But Legere did not specify in the tweet or video that the nationwide 5G excludes 40% of the US population.

☝️First *NATIONWIDE* 5G ‼️‼️‼️‼️☝️

That’s the @TMobile way 🙌 #Nationwide5G

— John Legere (@JohnLegere) December 2, 2019

The 5G service T-Mobile announced today isn’t much faster than T-Mobile’s 4G service. That’s because the “nationwide” 5G covering 60% of the population uses the same 600MHz spectrum that T-Mobile already uses for 4G. The big speed increases on 5G are expected to come from millimeter-wave spectrum, but those higher frequencies don’t travel as far and are being used primarily in densely populated urban areas.

AT&T acknowledged last month that its 5G service on low-band spectrum offers only 4G-like speeds this year, with actual speed increases coming next year. Verizon has said that 5G on low-band spectrum will be more like “good 4G,” and T-Mobile said in April that millimeter-wave 5G “will never materially scale beyond small pockets of 5G hotspots in dense urban environments.”

https://arstechnica.com/?p=1626329

If you feel like you don’t want to spend much time on Facebook anymore but don’t want to lose up to 15 years’ worth of shared photos, good news: the company is rolling out a tool that will let you export your image library directly to Google Photos.

Facebook announced the new tool in a corporate blog post today. The initiative springs from the Data Transfer Project, a collaboration among Apple, Facebook, Google, Microsoft, and Twitter to make some data transferable among those platforms.

The pilot begins this week in Ireland (where Facebook has been under investigation for alleged violations of EU data privacy law). The tool is then expected to roll out to users in the rest of the world sometime in the first half of 2020. Users who have the option available to them will see the tool in Facebook’s settings under Your Facebook Information.

If you’re not keen on putting your images into Google Photos either, there will in theory be other platforms made available in the future. For now, Facebook did not specify what the platforms are, nor did the company provide a timetable.

Ahead of the law

Facebook’s gesture is not borne of pure magnanimity. A bevy of probes and investigations, together with enforcement of new laws, are likely forcing the company’s hand.

You can make the argument that a company hoarding consumers’ data for itself, and refusing to release it to a competitor if the consumer asks, is in violation of antitrust law. Facebook currently is under antitrust investigation by basically every US regulator that has antitrust authority, both state and federal, and may well prefer to avoid antagonizing those regulators at this time.

Lawmakers worldwide are also forcing the issue. Europe’s General Data Protection Regulation (GDPR), which went into effect in 2018, includes a “right to data portability” for consumers. Here in the States, the California Consumer Privacy Act also provides for a right to data portability. That law goes into effect next month.

Federal legislators are also trying to address the issue. A bipartisan group of senators, including Richard Blumenthal (D-Conn.), Josh Hawley (R-Mo.), and Mark Warner (D-Va.), in October proposed a bill that would require US firms to make user data portable. Additionally, two other proposed sweeping privacy and data reform bills—one in the House and one in the Senate—both include explicit rights to data portability.

https://arstechnica.com/?p=1626247

Transplanted stem cells can be as lifesaving as donated organs, but the Food and Drug Administration in September warned consumers that some stem cell clinics only pretend to be in the business of miraculous recoveries.

Now, Google is attempting to protect its users after years of showing ads for questionable stem cell treatments. The company stated that it will stop allowing “bad actors” to post Google ads that “take advantage of individuals by offering untested, deceptive treatments.” Enforcement of the new policy started at the end of October, said Google spokesperson Alex Krasov. That change, while helpful, is unlikely to shutter clinics that cloak themselves in a façade of reputable science in order to peddle questionable stem cell treatments.

https://arstechnica.com/?p=1604543

Louisiana has brought some of its services back as it recovers from a targeted ransomware attack using the Ryuk malware on November 18. The state’s Office of Motor Vehicles re-opened offices on Monday in a limited fashion. But OMV and other agencies affected—including the state’s Department of Health and Department of Public Safety—are facing a number of potential hurdles to restoring all services, according to people familiar with Louisiana’s IT operations.

The ransomware payload was apparently spread across agencies by exploiting Microsoft Windows group policy objects—meaning that the attackers had gained access to administrative privileges across multiple Active Directory domains. This is symptomatic of TrickBot malware attacks, which uses GPOs and PsExec (a Microsoft remote administration tool) to spread its payload.

This is the second major cybersecurity incident this year in Louisiana tied to Ryuk ransomware. In July, Governor John Bel Edwards declared a state of emergency and deployed the state’s cyber response team to assist seven parish school districts. There have been many other Ryuk attacks this year that have used TrickBot and, in some cases, the Emotet trojan—an attack referred to by some experts as a “Triple Threat” commodity malware attack. At least two Florida cities and Georgia’s Judicial Counsel and Administrative Office of the Courts were also hit by “Triple Threat” attacks.

Mind the gap

According to testimony by Deputy Chief Information Officer Neal Underwood before the Louisiana legislature’s Joint Legislative Committee on the Budget, only 10% of the state’s 5,000 servers were affected by the ransomware attack, and a total of about 1,500 computers of the state’s 30,000 systems were “damaged” by the ransomware. Others were taken offline as a precaution as part of the response to the attack. And OMV officials and a spokesperson for the office of Louisiana’s secretary of state—which had to shut down systems tied to election data in the midst of vote recounts in Louisiana’s elections—declared that no data was lost in the attack.

But that declaration may have been early and certainly did not apply across all Louisiana’s agencies. Some data may be lost, as agencies’ file backups were in some cases not current. In a letter in response to a public information request shared with Ars, an attorney for the Louisiana Department of Public Safety stated that the request could not be completed because records required for the response were unavailable “due to the recent ransomware attack on the state’s computer systems.”

Some offices of the OMV still have not re-opened, as their personal computers remain disconnected from the agency’s network because they have not yet been checked for malware. And significant amounts of data—including records for the state’s Medicare and Medicaid system—may have been lost because backups maintained by Louisiana Department of Health’s data center vendor were over six months old. While the state contracted out operations of LDH’s data center, database servers and other systems remained accessible to Louisiana Office of Information Technology administrators.

https://arstechnica.com/?p=1624565

Reports of poor and unsafe working conditions within Amazon’s sprawling web of warehouses have been surfacing for years. A new report alleges that not only did conditions in one Indiana warehouse lead to a worker’s death in 2017 but also that state authorities manipulated a report on the matter in a futile attempt to bring Amazon’s much-vaunted “HQ2” to town.

Amazon worker Phillip Lee Terry was crushed and killed in September 2017 while performing maintenance on a forklift at Amazon’s Plainfield, Illinois, fulfillment center, according to a recent report from the Center for Investigative Reporting. While investigating Terry’s death, Indiana regulators found that he had never been given formal safety training that could have prevented the incident.

“The safety issues I’ve brought up have been dismissed and not dealt with,” another worker at the Plainfield facility told the safety inspector from Indiana’s OSHA department. “There’s no training, there’s no safety, it’s ‘Get ‘er done.'” Ultimately, the department issued four citations to Amazon, totaling $28,000 in penalties.

Burying the evidence

Two months after the accident, the inspector joined his boss, Indiana OSHA Director Julie Alexander, on a phone call with Amazon. He recorded the call, during which Alexander explained to Amazon how to negotiate for lower fines. After the call, CIR reports, Alexander said to the inspector, “I hope you don’t take it personally if we have to manipulate your citations” and discussed how Amazon could perceive Indiana’s flexibility as a positive.

Several days later, CIR reports, the investigator found himself face to face with the state’s commissioner of labor as well as the governor, where he was told to back off or resign. The investigator chose to resign shortly thereafter and warned federal officials about what he had experienced.

The probe essentially ended at that point, CIR says:

A year after Terry’s death, Indiana officials quietly signed an agreement with Amazon to delete all the safety citations and fines. The agreement said Amazon had met the requirements of an “unpreventable employee misconduct defense.” The official record now essentially blames Terry for his own death.

All of Indiana’s manipulation, however, was for naught. In November 2018, Amazon confirmed it would split its new offices between New York City and Washington, DC. (After widespread opposition, Amazon in February scrapped the New York location but is moving forward with its expansion in Arlington, Virginia, a stone’s throw from the Pentagon.)

CIR also describes an incident early in 2019 when a gas leak occurred at Amazon’s Eastvale, California, facility. Several workers were made severely ill by the fumes. One employee who called 911 to report the incident told the dispatcher that Amazon refused to suspend operations and was requiring workers to use personal time if they wanted to evacuate the facility. (An Amazon spokesperson told CIR that workers who complained about the docked time had it reversed.)

As part of their reporting, CIR shared an interactive map to look up worker injury rates warehouse by warehouse. According to their reporting, the most dangerous Amazon facility is in Troutdale, Oregon, near Portland, which reported nearly 26 serious injuries per 100 workers in 2018, about 6.5 times higher than the industry average.

The last mile

In addition to the hazardous warehouse conditions in the CIR report, workers often face unsafe conditions as packages leave the warehouse.

NBC News today published the results of an investigation into Amazon’s delivery logistics business, based in part on interviews with 18 current or former Amazon employees or contractors in 11 states. Amazon now delivers about 50% of all its packages itself, but that rapid expansion has led to “a chaotic environment” where drivers are put in impossible situations, NBC found.

Background checks on Prime delivery drivers are far more sporadic than they should be, NBC found, and lax enforcement of safety protocols within the warehouses can allow basically anyone to get to work. Several sources told NBC that drivers share and swap ID badges without ever having them verified, even though Amazon policy calls for those badges to be examined when a driver leaves the warehouse with a load of packages.

(Amazon told NBC that failing to conduct a background check on delivery drivers is in violation of company policy. But the company “did not say how it enforces that policy, or how often it has received reports of violations,” NBC notes.)

High quotas also lead to drivers making choices that jeopardize their own health and safety in addition to the safety of others on the road. One driver described to NBC an expectation that he would deliver 300 packages in a day (a little under one per minute, not counting the breaks several states mandate in an eight-hour work shift).

“You don’t take your lunch break. You don’t use the bathroom… There were guys peeing in bottles in the van,” he said, including himself in that category. “You speed. You run stop signs in a neighborhood… You start conditioning yourself to just go as fast as possible.”

Going as fast as possible, of course, is a recipe for disaster, and several fatal incidents involving Amazon Prime delivery vans have occurred nationwide. Multiple previous reports have probed the sprawling web of third-party contracting and subcontracting firms that allow Amazon to avoid legal liability in cases of crashes or deaths.

https://arstechnica.com/?p=1624473

For the first two decades of the commercial Internet, we celebrated the Internet as one of society’s greatest inventions. After all, the Internet has led to truly remarkable outcomes: it has helped overthrow repressive political regimes, made economic markets more efficient, created safe spaces for otherwise marginalized communities to find their voices, and led to the most exquisite cat videos ever seen.

But in the last few years, public perceptions of the Internet have plummeted. We’ve lost trust in the Internet giants, who seem to have too much power and make missteps daily. We also are constantly reminded of all of the awful and antisocial ways that people interact with each other over the Internet. We are addicted to the Internet—but we don’t really love it any more.

Many of us are baffled by the degradation of the Internet. We have the ingenuity to put men on the Moon (unfortunately, only men so far), so it defies logic that the most powerful companies on Earth can’t fix this. With their wads of cash and their smart engineers, they should nerd harder.

So why does the Internet feel like it’s getting worse, not better? And, more importantly, what do we do about it?

It was always thus

Let’s start with the feeling that the Internet is getting worse. Perhaps this reflects an overly romantic view of the past. The Internet has always had low-value content. Remember the Hamster Dance or the Turkish “I Kiss You” memes?

More generally, though, this feeling reflects our overly romantic view of the offline world. People are awful to each other, both online and off. So the Internet is a mirror of our society, and as the Internet merges into everyday life, it will reflect the many ways that people are awful to each other. No amount of nerding harder will change this baseline of antisocial behavior.

Furthermore, the Internet reflects the full spectrum of human activity, from great to awful. With the Internet’s proliferation—and with its lack of gatekeepers—we will inevitably see more content at the borders of propriety, or content that is OK with some audiences but not with others. We’ve also seen the rise of weaponized political content, including from state-sponsored entities, designed to propagandize or to pit communities against each other.

There is no magical way to eliminate problematic content or ensure it reaches only people who are OK with it. By definition, this content reflects edge cases where mistakes are most common, and it often requires external context to properly understand. That context won’t be available to either the humans or the machines assessing its propriety. The result is those infamous content moderation blunders, such as Facebook’s removal of the historic “Napalm Girl” photo or YouTube’s misclassification of fighting robot videos as animal abuse. And even if the full amount of necessary context were available, both humans and machines are susceptible to biases that will make their decisions seem wrong to at least one audience segment.

There’s a more fundamental reason why Internet companies can never successfully moderate content for a mass audience. Content moderation is a zero-sum game. With every content decision, the Internet companies make winners and losers. The winners get the results they wanted; the losers don’t. Hence, there’s no way to create win-win content-moderation decisions. Internet companies can—and are trying to—improve their content moderation efforts. But dissatisfaction with that process is inevitable regardless of how good a job the Internet companies do.

So given that Internet companies can never eliminate awful content, what should regulators do?

The downside of “getting tough”

One regulatory impulse is to crack down harder on Internet companies, forcing them to do more to clean up the Internet. Unfortunately, tougher laws are unlikely to achieve the desired outcomes for three reasons.

First, because of its zero-sum nature, it’s impossible to make everyone happy with the content moderation process. Worse, if any law enables lawsuits over content moderation decisions, this virtually ensures that every decision will be “litigation bait.”

Second, tougher laws tend to favor incumbents. Google and Facebook are OK with virtually any regulatory intervention because these companies mint money and can afford any compliance cost. But the companies that hope to dethrone Google and Facebook may not survive the regulatory gauntlet long enough to compete.

Third, some laws expect Internet companies to essentially eliminate antisocial behavior on their sites. Those laws ignore the baseline level of antisocial behavior in the offline world, which effectively makes Internet companies liable for the human condition.

The logical consequence of “tougher” Internet laws is clear but chilling. Google and Facebook will likely survive the regulatory onslaught, but few other user-generated content services will. Instead, if they are expected to achieve impossible outcomes, they will shut down all user-generated content.

In its place, some of those services will turn to professionally generated content, which has lower legal exposure and is less likely to contain antisocial material. These services will have to pay for professionally generated content, and ad revenue won’t be sufficient to cover the licensing costs. As a result, these services will set up paywalls to charge users for access to their databases of professionally licensed content. We will shift from a world where virtually everyone has global publication reach to a world where most readers will pay for access to a much less diverse universe of content.

In other words, the Internet will resemble the cable industry circa the mid-1990s, where cable subscribers paid monthly subscription fees to access a large but limited universe of professionally produced content. All of the other benefits we currently associate with user-generated content will just be fond memories of Gen Xers and millennials.

https://arstechnica.com/?p=1624103

Perhaps the third time’s the charm: a group of Senate Democrats, following in the recent footsteps of their colleagues in both chambers, has introduced a bill that would impose sweeping reforms to the current disaster patchwork of US privacy law.

The bill (PDF), dubbed the Consumer Online Privacy Rights Act (COPRA), seeks to provide US consumers with a blanket set of privacy rights. The scope and goal of COPRA are in the same vein as Europe’s General Data Protection Regulation (GDPR), which went into effect in May 2018.

Privacy rights “should be like your Miranda rights—clear as a bell as to what they are and what constitutes a violation,” Sen. Maria Cantwell (D-Wash.), who introduced the bill, said in a statement. Senators Amy Klobuchar (D-Minn.), Ed Markey (D-Mass.), and Brian Schatz (D-Hawaii) also co-sponsored the bill.

The press release announcing the bill also includes statements of support from several consumer and privacy advocacy groups, such as Consumer Reports, the Electronic Privacy Information Center (EPIC), the Georgetown Law Center on Privacy & Technology, and the NAACP.

What’s in the bill?

The proposals within COPRA fall basically into three main buckets: enumerated rights for consumers, data-handling requirements for businesses, and enforcement mechanisms.

As explained in a one-page summary of the bill (PDF), the rights consumers would gain from COPRA include:

• The right to be free from deceptive and harmful data practices; financial, physical, and reputational injury, and acts that a reasonable person would find intrusive, among others
• The right to access their data and greater transparency, which means consumers have detailed and clear information on how their data is used and shared
• The right to control the movement of their data, which gives consumers the ability to prevent data from being distributed to unknown third parties
• The right to delete or correct their data
• The right to take their data to a competing product or service

On the company side, businesses would be required to demonstrate that they take “preventive and corrective actions” to protect consumer data from leaks, breaches, hacks, or other kinds of misappropriation. Highly sensitive data, such as biometric data and geolocation data, would also be subject to stronger standards for protection and use.

The bill would put responsibility for enforcement in the hands of the Federal Trade Commission, which would also be tasked with creating specific new rules detailing the processes covered entities would be required to follow.

COPRA also seems to take the challenges the EU and consumers have faced since the GDPR went into effect into account, as it specifically tasks the FTC with making sure those rules not only require “clear and conspicuous” notices to opt in or opt out of data collection and transfers but also “to minimize the number of opt-out designations of a similar type that a consumer must make” (such as an “accept cookies” warning on every single website one visits).

https://arstechnica.com/?p=1624123

Climate scientists take a lot of abuse. The political opposition to climate science in some countries breeds nasty attacks on the scientists themselves. Penn State’s Michael E. Mann, for example, became a favorite target after his work on tree-ring records of past climate produced a “hockey stick” graph showing that a gradual cooling trend flipped into sharp, human-caused warming.

In 2012, Mann decided he’d had enough and did something few other scientists have—he filed a defamation lawsuit. After years bouncing around in court, with the defendants appealing decisions that would let the case proceed, the suit’s last obstacle was cleared Monday as the Supreme Court declined to hear an appeal. A 2016 decision by a District of Columbia court will stand, and the case will now have to be heard.

The original suit was prompted by articles written by Conservative columnist and radio show host Mark Steyn and Rand Simberg of the Conservative Enterprise Institute. The articles claimed that Mann’s research was fraudulent—that he had intentionally manipulated data. And Simberg added a regrettable analogy that Steyn quoted in his piece: “Mann could be said to be the Jerry Sandusky of climate science, except for instead of molesting children, he has molested and tortured data.”

There is nothing to the claim of data manipulation. Mann is far from the only researcher in this field, and further studies have confirmed and extended the earlier results he was involved in. And because Mann’s emails were among those hacked and released from University of East Anglia scientists in 2009, that wet thud of a controversy triggered a number of investigations by universities and other institutions, all of which found he had done nothing improper. Those investigations were complete before Steyn and Simberg wrote their articles.

https://arstechnica.com/?p=1624051