AT&T has agreed to pay $60 million back to customers to settle a Federal Trade Commission lawsuit over the carrier’s severe throttling of mobile data plans advertised as “unlimited.”

The FTC, which sued AT&T in 2014, announced the settlement today. The deal ends a long saga in which AT&T unsuccessfully tried to cripple the FTC’s regulatory authority over telecoms. A court loss last year basically forced AT&T to settle the case.

“AT&T promised unlimited data—without qualification—and failed to deliver on that promise,” FTC Bureau of Consumer Protection Director Andrew Smith said in the announcement. “While it seems obvious, it bears repeating that Internet providers must tell people about any restrictions on the speed or amount of data promised.”

Under the settlement, AT&T did not admit or deny any of the allegations made by the FTC.

AT&T’s current and former customers who were affected by the throttling won’t have to do anything to get their refunds, according to the FTC. The commission said:

The $60 million paid by AT&T as part of the settlement will be deposited into a fund that the company will use to provide partial refunds to both current and former customers who had originally signed up for unlimited plans prior to 2011 but were throttled by AT&T. Affected consumers will not be required to submit a claim for the refunds. Current AT&T customers will automatically receive a credit to their bills while former customers will receive checks for the refund amount they are owed.

Refunds within 90 days of court approval

AT&T must pay the $60 million within seven days after the settlement is approved by the US District Court for the Northern District of California. AT&T would have to identify each eligible consumer within 30 days and give bill credits and refund checks to existing and former customers within 90 days.

If there is any leftover money, it must be paid to the FTC, which would try to provide further relief to customers.

“If a representative of the Commission decides that direct redress to consumers is wholly or partially impracticable or money remains after redress is completed, the Commission may apply any remaining money for such other equitable relief (including consumer information remedies) as it determines to be reasonably related to Defendant’s practices alleged in the Complaint,” the settlement says.

The FTC sued AT&T five years ago because the carrier was throttling unlimited data plans after customers used either 3GB or 5GB each month, depending on which plan they had. AT&T enforced the throttling 24 hours a day for the rest of the monthly billing period, making the service pretty much unusable. Downloads were throttled to speeds as low as 128kbps, according to the FTC.

AT&T eventually eased up on the throttling, changing the policy so that customers would be throttled only when the network is congested. Speeds are returned to normal if the network congestion clears up or if the customer moves to an un-congested location.

AT&T’s newest “unlimited” plans include one that can be throttled in congested areas regardless of how much data a customer has used. The pricier unlimited plans allow either 50GB or 100GB each month before throttling is enabled in congested areas.

AT&T noted that it has changed its ways in its statement on the settlement. “Even though it has been years since we applied this network management tool in the way described by the FTC, we believe this [settlement] is in the best interests of consumers,” AT&T said in a statement provided to Ars.

Besides the refunds, the FTC said that AT&T must prominently disclose limitations to its mobile plans:

As part of the settlement, AT&T is prohibited from making any representation about the speed or amount of its mobile data, including that it is “unlimited,” without disclosing any material restrictions on the speed or amount of data. The disclosures need to be prominent, not buried in fine print or hidden behind hyperlinks. For example, if an AT&T website advertises a data plan as unlimited, but AT&T may slow speeds after consumers reach a certain data cap, AT&T must prominently and clearly disclose those restrictions.

AT&T already discloses these limitations, but it might have to make the disclosures more prominent to comply.

“AT&T baited subscribers”

FTC Commissioner Rohit Chopra, who is part of the commission’s Democratic minority, issued a lengthy statement today about the settlement and AT&T’s treatment of customers.

Chopra said:

AT&T baited subscribers with promises of unlimited data, trapped them in multi-year contracts with punishing termination fees, and then scammed them by choking off their access unless they moved to a more expensive plan… The AT&T throttling scandal is an important case study into how dominant firms operating without meaningful competition can easily renege on their contractual obligations and cheat consumers who have almost no recourse.

Chopra said he wanted AT&T to pay more, but he praised FTC staff for keeping the case alive and getting the deal done.

“No settlement is perfect. While I would have liked to see AT&T pay more for the company’s scheme, I fully appreciate the risks and resources associated with litigation,” Chopra said.

AT&T avoided trial

AT&T issued a statement in response to Chopra’s criticism. “We couldn’t disagree more with Commissioner Chopra’s baseless characterization of the case,” AT&T said.

AT&T further said that “none of [Chopra’s] allegations were ever proved in court.” But that’s because the years of legal wrangling that preceded today’s settlement mostly centered on whether the FTC had authority to regulate AT&T.

The FTC is barred from regulating common carriers under US law, and AT&T seized on that fact to drag out the case even though mobile broadband isn’t a common-carrier service. AT&T is a common carrier when it comes to mobile voice and landline phone services, and it claimed that the FTC thus can’t regulate any part of AT&T’s business. Even non-common carrier services offered by AT&T could not be regulated by the FTC if AT&T’s legal argument had held.

AT&T’s attempt to cripple the FTC’s authority was rejected in a February 2018 decision by the US Court of Appeals for the 9th Circuit. That ruling overturned a previous one that had gone in AT&T’s favor.

The February 2018 ruling could have led to a US District Court trial over the throttling allegation if the sides hadn’t settled. At one point, a trial was scheduled to begin in February 2020.

The FTC should keep a close eye on AT&T going forward, Chopra said:

It will be critical for the Commission to closely scrutinize AT&T’s moves under order. If the company violates any aspect of this settlement, the agency should seek a contempt judgment in federal court and hold both the company and any appropriate individuals responsible for flouting the order. Given AT&T’s aggressive enforcement of arbitration clauses that ban consumers from taking the company to court, it is critical to be vigilant in our oversight of AT&T under this order.

In June 2015, the Federal Communications Commission proposed that AT&T pay a fine of $100 million for the throttling, but it never finalized the penalty.

https://arstechnica.com/?p=1597101

8chan was back online this week—albeit with a new name—three months after the site was essentially kicked off the public Internet. 8Chan is now called 8kun and located at 8kun.net. (In Japanese, “chan” is generally an honorific for children while “kun” is generally an honorific for young adults.)

We were able to access the site this morning, but it’s offline again now around mid-day. 8chan administrator Ron Watkins previously warned that DDoS attacks and people protesting against 8chan’s re-emergence could cause problems.

“Not sure how long we will be able to stay online with clearnet due to activists trying to deplatform us, and hackers preparing to ddos us. The tor hidden service should remain available regardless,” Watkins wrote on Twitter Saturday. 8kun was also available on Loki, which Watkins described as an experimental alternative to Tor.

8kun is using Tucows as its registrar, and a Vice report says that 8kun’s hosting service is the Russia-based Media Land LLC. Media Land was recently described as a “bulletproof hosting service” by security reporter Brian Krebs. It’s not clear if the 8kun administrators found a full replacement for Cloudflare’s anti-DDoS services.

“We have been under sustained attacks the past few days and doing everything we can to get things stable again,” Watkins wrote on Twitter today, shortly before the site went down again. “The site is still online—albeit limping along—as we reorganize and restructure to deflect attacks coming from many angles.”

8chan founder Fredrick Brennan, who quit the site and now advocates against it, wrote on Twitter today that “8kun’s host is best known for hosting ransomware and phishing websites.” 8kun was using an unallocated IP address, “which is if not illegal, [an] extremely bad practice that many ISPs… shun,” Brennan wrote. These are also known as “bogon” or bogus IP addresses.

Cloudflare booted 8chan after shooting

Cloudflare cut 8chan off in early August after a mass shooting in El Paso, Texas, that killed 22 people. The accused shooter had apparently posted a racist manifesto on 8chan just before the attack. 8chan was previously used similarly by perpetrators of attacks at a mosque in Christchurch, New Zealand, and a synagogue in Poway, California.

“8chan has repeatedly proven itself to be a cesspool of hate,” Cloudflare CEO Matthew Prince wrote when he announced his decision to stop providing services to the site.

“They have proven themselves to be lawless and that lawlessness has caused multiple tragic deaths,” Prince also wrote. “Even if 8chan may not have violated the letter of the law in refusing to moderate their hate-filled community, they have created an environment that revels in violating its spirit.”

8chan temporarily got back online in early August, shortly after losing Cloudflare service. 8chan switched its website to a provider called BitMitigate, the same company that began serving the Daily Stormer after Cloudflare cut it off. But that didn’t last long, either, as BitMitigate’s cloud infrastructure provider decided to shut off BitMitigate’s service.

8chan owner Jim Watkins testified to Congress in September, claiming that 8chan was “offline voluntarily” and would come back online when it “is able to develop additional tools to counter illegal content under United States law.”

Watkins said 8chan takes action to remove child pornography and “true threats,” but it “has no intention of deleting constitutionally protected hate speech.”

https://arstechnica.com/?p=1596823

Apple has pledged $2.5 billion to help address California’s affordable-housing crisis, the company announced on Monday. In recent years, the San Francisco Bay Area has become the most expensive housing market in America. Los Angeles also suffers from housing costs far above the national average.

Apple’s $2.5 billion package includes several different initiatives. Apple will offer a $1 billion line of credit to organizations building housing for low-income people.

Another $1 billion will be used to help first-time homebuyers—especially “essential service personnel, school employees, and veterans.” In communities like Cupertino, where Apple is based, cops and schoolteachers often struggle to afford housing near their jobs.

Apple says it will also donate land worth $300 million in San Jose for a project to build thousands of new affordable housing units. Another $150 million will go to support various affordable housing projects in Silicon Valley, while a final $50 million is earmarked for a nonprofit that focuses on homelessness in Silicon Valley.

Apple’s commitment follows on the heels of similar announcements by other technology giants:

• In January, Microsoft said it would provide $500 million in grants and loans to promote affordable housing in the Seattle area and aid the homeless.
• In June, Google announced a $1 billion initiative, including $750 million worth of Google-owned land, to support the development of at least 20,000 new housing units “at all income levels” in the San Francisco Bay Area.
• In October, Facebook unveiled its own initiative to offer $1 billion in grants and loans to support the construction of 20,000 housing units in the region.

Apple’s initiative is larger than the other programs and appears to be more focused on low-income housing.

Corporate initiatives alone can’t fix California’s housing problem

These efforts to promote affordable housing are laudable, but corporate initiatives alone are unlikely to solve California’s housing crisis. The Golden State’s fundamental housing problem is that state and local laws simply don’t allow developers to build enough housing to accommodate rising demand.

In the 20th century, cities could accommodate growing demand for housing by pushing suburbs outwards. But in major metropolitan areas like San Francisco and Los Angeles, that process has largely run its course. Most of the land within a reasonable driving distance of job centers has been developed. Which means that the only way to accommodate further growth is by increasing density: replacing single-family homes with duplexes, townhouses, and apartment buildings.

The problem is that the law doesn’t allow this in most areas. A Los Angeles Times analysis found that 62% of land in Los Angeles is zoned for single-family homes only. In San Francisco, 75% of the land is zoned not to allow anything denser than a duplex. Laws in suburban Silicon Valley are even stricter.

At the same time, the technology boom has put more and more money in the hands of residents associated with the technology sector. So more and more dollars are chasing housing, while the supply of housing has barely increased from year to year.

The Apple, Google, and Facebook initiatives aim to address this by either subsidizing the development of specific housing projects or by helping lower-income homeowners afford the inflated cost of housing. These are worthwhile initiatives, but there’s only so much they can accomplish while the overall supply of housing is so strictly limited.

If Apple provides some low-income families with financial assistance to buy homes, that helps those homeowners. But there’s a risk that this simply means that other families with similar incomes—but without help from Apple—get priced out of the market.

Legislation to liberalize housing regulations got tabled

Ultimately, the only way to make housing affordable is to build a lot more of it. And that won’t happen without changes to the law.

This year, state Sen. Scott Wiener, a Democrat who represents part of San Francisco, sought passage of legislation to overhaul the state’s zoning rules. His bill would loosen housing regulations near bus stops, subway stations, and areas with a lot of jobs, allowing for the construction of more apartment buildings nearby. A boom in high-density apartment construction could alleviate the state’s severe housing shortage and slow the seemingly inexorable rise in housing costs.

But the bill has attracted strong criticism—both from tenants’ rights groups worried that it would accelerate the process of gentrification and from neighborhood activists who simply don’t want apartment buildings built near their single-family homes. Opponents managed to get the bill shelved in May. It is due to come up for reconsideration next year.

https://arstechnica.com/?p=1596207

DirecTV and Comcast are being investigated by Colorado Attorney General Phil Weiser, who objects to the TV providers continuing to charge regional sports network (RSN) fees despite not providing one of the major regional sports networks. While Comcast is giving customers partial bill credits, DirecTV apparently hasn’t done so.

Weiser sent letters to the AT&T-owned DirecTV and Comcast on October 23, asking why the companies kept charging RSN fees after they stopped providing the Altitude Sports network. The network broadcasts games played by the state’s major professional basketball, hockey, and soccer teams (the Denver Nuggets, Colorado Avalanche, and Colorado Rapids, respectively). The AG’s letters said that Comcast’s and DirecTV’s conduct “may constitute a deceptive trade practice under the Colorado Consumer Protection Act” and “may result in the imposition of civil penalties up to $20,000 per violation.” The letters also said the AG is investigating other potentially misleading fees.

Altitude was blacked out on both DirecTV and Comcast two months ago because the TV providers didn’t want to pay Altitude as much as it asked for. Altitude finally reached a deal with DirecTV a few days ago but is still negotiating with Comcast. Altitude is also blacked out on Dish satellite TV, but Dish doesn’t charge a regional sports network fee.

Comcast giving partial bill credits

Comcast responded to the AG’s office with a letter on October 31, saying that it had already begun giving partial credits to customers. Comcast’s RSN fee in Colorado is $8 a month, while DirecTV charges $8.50, according to the AG’s letters.

Comcast wrote in its letter to the AG:

Comcast has been proactive and has shared both publicly and in direct communications with its customers that we are providing a partial credit of the RSN fee, due to Comcast not currently carrying Altitude as part of our cable packages in Colorado. Comcast continues to provide other regional sports programming which accounts for the remaining RSN fee charged to customers.

The other regional sports programming offered by Comcast includes the AT&T SportsNet Rocky Mountain channel, which broadcasts Colorado Rockies baseball games, and the Pac-12 network that broadcasts college sports.

We asked Comcast how big of a credit it is giving to customers, but the company declined to provide a specific number. Comcast told us that “the amount of the partial credit varies based on what RSNs are available in the customers’ area.”

AT&T actions “very concerning”

Weiser’s office gave both companies until November 7 to respond. Comcast said it will provide an additional, more detailed response to the AG by then. AT&T’s DirecTV division hasn’t responded to Weiser’s office yet, Weiser’s office told Ars today. We contacted AT&T today and will update this article if we get a response.

The actions of DirecTV, which apparently hasn’t offered credits to customers, have been “very concerning,” Weiser told The Denver Post.

“Based on early conversations with DirecTV and AT&T, we didn’t believe they were taking the request with the seriousness that they should,” a spokesperson for Weiser also told the Post.

AT&T would have less of an excuse than Comcast to keep charging an RSN fee while Altitude was blacked out, because AT&T itself owns the other major RSN for professional sports in Colorado. TV providers claim they need to charge customers RSN fees to cover the high carriage prices charged by regional sports networks. But when the TV provider owns the network, as AT&T does with AT&T SportsNet Rocky Mountain, those carriage payments are simply going from one part of the company to another.

Comcast also owns regional sports networks, but none in Colorado.

While Weiser’s inquiry to Comcast and DirecTV focused mainly on charging the RSN fee during the Altitude blackout, the AG is also conducting a broader investigation into fees charged by TV and broadband providers. The letters to Comcast and DirecTV said:

In addition to investigating the assessment of a Regional Sports Fee, the OAG [Office of the Attorney General] has opened an investigation of other fees and charges that providers impose on subscribers of television and Internet services that have the potential to confuse and mislead consumers. The imposition of such fees and charges may violate [state law on deceptive trade practices].

Years of controversy

The RSN fees have long been controversial. Comcast, DirecTV, and other providers don’t include RSN fees in their advertised prices, so they contribute to the bill shock customers experience when they find out they’re going to pay more than the companies claimed they would. TV providers also routinely raise RSN fees even while customers are under contract.

Comcast’s regional sports fee was only $1 in 2015 but has increased eight-fold since then. Comcast told Ars that it “itemizes the RSN fee to be transparent with our customers about the factors driving pricing.” TV providers have used the same approach with “broadcast TV” fees, which they say cover the cost of retransmission consent fees paid to broadcast networks.

Colorado is not the first state to investigate RSN fees. Minnesota Attorney General Lori Swanson sued Comcast in December 2018, alleging among other things that Comcast reps falsely told customers that the company’s RSN and broadcast TV fees were mandated by the government and not controlled by Comcast itself. Comcast was also sued by customers over the sports and broadcast TV fees in 2016, but the case was settled in 2018.

Separately, Cord Cutters News reported last week that Comcast has been removing other channels from TV packages but not lowering its prices.

https://arstechnica.com/?p=1596243

A week after members of Congress expressed concern about Chinese ownership of popular short-form video app TikTok, national security regulators are taking a closer look.

Regulators are indeed now reviewing TikTok for national security concerns, Reuters reports.

The review is being run by the Committee on Foreign Investment in the United States, or CFIUS, a formerly obscure interagency group. CFIUS, based out of the Treasury Department, comprises members from a dozen different agencies who review transactions in which an international business acquires a US business for national security concerns.

TikTok and its parent company, ByteDance, are in talks with CFIUS “about measures it could take to avoid divesting” the US assets it acquired, people familiar with the matter said. Reuters granted its sources anonymity, as CFIUS does not comment publicly on its investigations and is barred from disclosing certain information.

C-what-US?

CFIUS has seen its profile increase amid rising trade tensions and sharp rhetoric between the US and China during the Trump administration. The committee made nationwide headlines for blocking the sale of US-based money-transfer company MoneyGram to China’s Ant Financial in early 2018.

The committee has also become more involved in high-tech transactions in recent years. It blocked the sale of a US semiconductor firm to a Chinese government-backed investment firm in 2017, and in 2018 it recommended against allowing Broadcom to acquire Qualcomm (a deal that probably wasn’t happening anyway) a week before President Trump signed an executive order blocking that deal on national security grounds.

CFIUS had its scope and mandate greatly expanded in 2018, when President Trump signed into law a “modernization” package that increased the committee’s finding and hiring authority, as well as expanding the types of transactions that were subject to significant scrutiny.

From Musical.ly to TikTok

The startup short-form video app Musical.ly launched in 2014 and quickly gained both popularity and funding in the years after. In 2016 and 2017, Musical.ly signed deals with Warner Music and Apple Music allowing users to integrate a broader library of tunes into their videos. A division of Beijing-based ByteDance snapped up Musical.ly for close to $1 billion in late 2017, then in 2018 sunset the Musical.ly name and product. Instead, ByteDance integrated its two extremely similar apps under the TikTok name.

CFIUS did not review the Musical.ly acquisition in 2017, meaning the committee has the authority retroactively to examine the transaction at this time.

Senators Tom Cotton (R-Ark.) and Chuck Schumer (D-N.Y.) last week pushed the intelligence community to open a formal investigation into TikTok, saying, “TikTok’s terms of service and privacy policies describe how it collects data from its users and their devices, including user content and communications, IP address, location-related data, device identifiers, cookies, metadata, and other sensitive personal information.” They add, “While the company has stated that TikTok does not operate in China and stores US user data in the US, ByteDance is still required to adhere to the laws of China.”

Earlier this year, Musical.ly reached a settlement with the Federal Trade Commission alleging it broke one of the few privacy laws that actually exist in the United States: the Children’s Online Privacy Protection Act.

The company paid $5.7 million, at the time the largest civil penalty ever imposed by the FTC in a COPPA case, to settle claims that it knowingly harvested and used personal data from users under age 13 without obtaining parental consent.

https://arstechnica.com/?p=1596019

The White House is apparently blinking in a contentious lawsuit over fuel efficiency standards, leaving a number of major automakers that had backed the administration in an awkward position.

The administration is considering abandoning a rule that would freeze fuel efficiency requirements at 2020 levels and instead replacing it with a rule that would require fleetwide improvements of about 1.5% per year, The Wall Street Journal reports today.

The move is the latest twist in a long and complicated standoff that began basically as soon as the Trump administration did. The man himself promised on the campaign trail to gut the Environmental Protection Agency and roll back Obama-era fuel efficiency standards for vehicles. The chain of events so far has led to a faceoff among automakers, as Honda, Ford, Volkswagen, and BMW back more stringent guidelines out of California, and General Motors, Toyota, Fiat Chrysler, Hyundai, Mazda, Nissan, and Kia stand with the White House against the rule.

The story so far…

In 2012—the middle of the Obama administration—the EPA adopted a fuel economy standard that would gradually increase the average miles-per-gallon rating for most cars to 54.5mpg by 2025 (about 40mpg under real-world conditions). The agency finalized that standard in late 2016.

When the Trump administration began in January 2017, that rule, like so many other policies from the Obama administration, immediately had a target on its back. In April 2018, the EPA officially said the standard was too high and kicked off the process to replace the rule with something weaker.

California, however, threw a wrench in those plans. Most states can’t set their own fuel-efficiency guideline, but California is a special case. For several decades, the smog-prone state has had a perennially renewed waiver that permits it to enforce stricter standards than the federal rule. The impact of that waiver goes far beyond the Golden State’s borders: the other 49 states can choose to adopt California’s stricter standards instead of the federal guideline, and at least 16 states have said they will back California’s emissions standard rather than support the federal rollback.

In July of this year, four major automakers—Honda, Ford, Volkswagen, and BMW—reached an agreement with California. That voluntary framework aims to improve their overall fleet’s average fuel efficiency by 3.7% per year, starting with the 2022 model year.

And then it got messy

The president did not exactly greet this new emissions agreement with open arms.

In September, the automakers all confirmed they had been contacted by the Department of Justice, which was taking preliminary steps in an antitrust investigation. The probe sought to determine whether the agreement comprised a cartel that unfairly restricted competition, The Wall Street Journal first reported.

Separately from the antitrust probe, the EPA and Department of Transportation in September sent a letter (PDF) to put California regulators “on notice.”

“This framework agreement appears to be inconsistent with federal law,” the agencies said. “We urge you to act immediately to disassociate [the California Air Resource Board] from the commitments made by the four automakers. Those commitments may result in legal consequences given the limits placed in Federal law on California’s authority.”

California Governor Gavin Newsom immediately accused the administration of trying to bully the state, saying, “We remain undeterred. California stands up to bullies and will keep fighting for stronger clean car protections that protect the health and safety of our children and families.”

That escalated quickly…

Matters escalated from there. Days later, both the House and Senate Judiciary committees sought to probe the probe. California Sen. Kamala Harris, a Democrat who is running for the 2020 presidential nomination, said in her letter to the DOJ, “This chain of events raises serious questions about whether federal law enforcement is being used to coerce the four automakers to abandon their efforts to make cleaner, less-polluting vehicles. It also raises questions about whether the machinery of the Justice Department is being used for partisan political purposes, or at the behest of special interest groups that oppose even modest efforts to reduce greenhouse gas emissions.”

In response, the Trump administration revoked the waiver that allows California to set its own emissions standard. California, as you might expect, sued back.

California was joined by 22 other states, as well as several cities, in its lawsuit (PDF) against the administration, arguing that the administration’s action, “be declared unlawful and set aside because it exceeds NHTSA’s authority, contravenes Congressional intent, and is arbitrary and capricious.”

The suit against California gained allies this week when the other major automakers joined the fray on the side of the administration.

https://arstechnica.com/?p=1594875

Nation-sponsored hackers have a new tool to drain telecom providers of huge amounts of SMS messages at scale, researchers said.

Dubbed “Messagetap” by researchers from the Mandiant division of security firm FireEye, the recently discovered malware infects Linux servers that route SMS messages through a telecom’s network. Once in place, Messagetap monitors the network for messages containing either a preset list of phone or IMSI numbers or a preset list of keywords.

Messages that meet the criteria are then XOR encoded and saved for harvesting later. FireEye said it found the malware infecting an undisclosed telecom provider. The company researchers said the malware is loaded by an installation script but didn’t otherwise explain how infections take place.

Targeting upstream data sources

The security firm said Messagetap belongs to APT41, one of several advanced persistent threat hacking groups that researchers say is sponsored by the Chinese government. The group is apparently using the malware to spy on high-ranking military and government officials. In a report, the researchers said the malware allows China’s intelligence services to obtain a wide range of sensitive data at scale.

“The use of MESSAGETAP and targeting of sensitive text messages and call detail records at scale is representative of the evolving nature of Chinese cyber espionage campaigns observed by FireEye,” the researchers wrote. “APT41 and multiple other threat groups attributed to Chinese state-sponsored actors have increased their targeting of upstream data entities since 2017. These organizations, located multiple layers above end-users, occupy critical information junctures in which data from multitudes of sources converge into single or concentrated nodes.”

Messagetap’s 64-bit Linux executable contains two configuration files. The first, parm.txt, contains lists of IMSI numbers and phone numbers of interest while keyword_parm.txt lists keywords. Both files are deleted from disk once loaded into memory. After that, Messagetap monitors all traffic passing over the network and looks for messages that match the criteria from the configuration text files. Messages sent to or from the phone or IMSI numbers are collected. Messages containing the keywords are also gathered. The malware parses all traffic at the Ethernet and IP layers and continues parsing protocol layers including SCTP, SCCP, and TCAP.

Researchers recovered the contents of the configuration files and found a “high volume of phone numbers and IMSI numbers.” Thursday’s report continued:

The inclusion of both phone and IMSI numbers show the highly targeted nature of this cyber intrusion. If an SMS message contained either a phone number or an IMSI number that matched the predefined list, it was saved to a CSV file for later theft by the threat actor. The targeted phone numbers and IMSI numbers belonged to foreign high-ranking individuals of interest to the Chinese government.

Similarly, the keyword list contained items of geopolitical interest for Chinese intelligence collection. Sanitized examples include the names of political leaders, military and intelligence organizations and political movements at odds with the Chinese government. If any SMS messages contained these keywords, MESSAGETAP would save the SMS message to a CSV file for later theft by the threat actor.

In addition to MESSAGETAP SMS theft, Mandiant also identified the threat actor interacting with call detail record (CDR) databases to query, save and steal records for specific individuals during this same intrusion. Targeting CDR information provides a high-level overview of phone calls between individuals, including time, duration, and phone numbers. In contrast, MESSAGETAP captures the contents of specific text messages.

While Messagetap isn’t likely to have monitored the vast majority of the infected telecom’s users, its existence shows that network providers aren’t the only entities that can tap phone networks. Its use demonstrates the prudence of not using phone networks to relay sensitive information unencrypted. The Signal messenger remains the best way to send encrypted texts between two phones.

https://arstechnica.com/?p=1594265

Twitter might be the president’s favored platform and a valued way for candidates to spread their messages far and wide, but starting next month, elected officials and candidates alike are going to have to make sure all that traffic comes organically. That’s because they won’t be allowed to pay for political advertising.

Twitter CEO Jack Dorsey has apparently taken a look at the controversy currently embroiling Facebook and decided he wants no part of it.

“We’ve made the decision to stop all political advertising on Twitter globally,” Dorsey announced in, naturally, a tweet.

He framed the choice as an opportunity for anyone with a message, rather than a penalty, adding, “A political message earns reach when people decide to follow an account or retweet. Paying for reach removes that decision, forcing highly optimized and targeted political messages on people. We believe this decision should not be compromised by money.”

The ban applies not only to candidates and their campaigns but also to “issue ads” by any group, Dorsey continued, since those “present a way to circumvent” the ban on political advertising and would present a situation where “everyone but candidates” could pay to have their view on an issue promoted. He also added an apparent dig at Facebook:

For instance, it’s not credible for us to say: “We’re working hard to stop people from gaming our systems to spread misleading info, buuut if someone pays us to target and force people to see their political ad… well…they can say whatever they want! 😉”

“This isn’t about free expression,” Dorsey went on. “This is about paying for reach. And paying to increase the reach of political speech has significant ramifications that today’s democratic infrastructure may not be prepared to handle. It’s worth stepping back in order to address.”

Direct challenge

The stance comes in direct opposition to social media leader Facebook, which explicitly exempts both posts and advertisements made by politicians from its community standards and fact-checking process.

Facebook CEO Mark Zuckerberg has repeatedly doubled down on his company’s position amid a firestorm of criticism from lawmakers, political candidates, and even employees. In a congressional hearing last week, Rep. Alexandria Ocasio-Cortez (D-N.Y.) directly challenged Zuckerberg on the company’s policy.

“Do you see a potential problem here with the complete lack of fact-checking on political advertisements?” Ocasio-Cortez asked.

“Well, congresswoman, I think lying is bad,” Zuckerberg replied. “I think if you’re gonna lie, that would be bad.” But that would be different from preventing people from “seeing that you had lied,” he tried to explain.

“So you will take down lies, or you won’t take down lies? I think this is a pretty simple yes or no,” she pressed.

“In a democracy, I believe that people should be able to see for themselves what politicians that they may or may not vote down are saying,” he answered. Any actions Facebook might take “depends on the context” in which a dishonest piece of content is posted, he added.

https://arstechnica.com/?p=1594105

Facebook about a month ago confirmed that politicians are exempt from its speech policies and ad standards. That policy frees up holders of political jobs, and candidates seeking those jobs, to, basically, lie their entire faces off in Facebook ads if they choose to do so.

The Internet and the 21st century being what they are, of course, many people greeted this news with responses along the lines of: “Does that mean I can just sign up for any local race and then put any ads I want on Facebook?” One man decided to find out. And so far, at least, the answer seems to be: No.

Adriel Hampton lives in California and runs a digital marketing firm that promotes progressive causes. On Monday, he formally registered as a candidate for the state’s gubernatorial race, and his stated platform explicitly challenges both President Donald Trump and Facebook CEO Mark Zuckerberg.

His plan, he told CNN, was to use his new status as a political candidate to buy ads on Facebook promoting false content about Trump, Zuckerberg, and others explicitly to call attention to Facebook’s policies and force the company to change them.

Who’s a politician?

Hampton’s bid to become the Golden State’s next head honcho isn’t his first foray into challenging Facebook’s ad policies. In fact, it’s not even his first headline-grabbing Facebook-related action in the last week.

Hampton also runs a political action committee, The Really Online Lefty League (TROLL), which a few days ago lived up to its name by purchasing a stunt advertisement claiming Sen. Lindsay Graham (R-S.C.) supports the Green New Deal, a progressive policy package and the signature proposal of Rep. Alexandria Ocasio-Cortez (D-N.Y).

Graham, who is a devoted Republican, is as ardent an opponent of the Green New Deal as you might expect and has said: “There’s not one Republican going to vote for anything coming out of the Green New Deal ‘cause it’s crazy.”

Facebook suspended the ad’s paid distribution. It said that—because the promotion came from a third-party PAC rather than directly from a candidate or politician—it was eligible for review and removal under the site’s policy.

Launching a campaign doesn’t appear to be enough to make Hampton a legitimately exempt advertiser in Facebook’s eyes, though. Facebook told CNN, “This person has made clear he registered as a candidate to get around our policies, so his content, including ads, will continue to be eligible for third-party fact-checking.”

Hampton responded to CNN that Facebook, “made a policy specific to me, and I am running for California governor to regulate Facebook,” adding, “I am going to look at suing them—I will immediately seek all available legal options.”

Beyond stunts

The fight around what Facebook does or does not allow on its site is already beyond exhausting—but it’s almost certainly going to get worse before (or if) it manages to get better. US politicians on all sides are wading into the fray, and with the 2020 election almost finally less than a year away, tensions are only going to intensify.

The current fight over political ads on Facebook began when President Donald Trump’s re-election campaign ran a false ad about former Vice President Joe Biden, who is among the leading candidates seeking the 2020 Democratic presidential nomination. The site refused to pull the spot, kicking off outrage, especially from Biden’s fellow Democrats.

Sen. Elizabeth Warren (D-Mass.), another leading contender in the crowded 2020 field, herself launched a false ad on Facebook earlier this month to draw attention to what she sees as the platform’s failings. “Breaking news,” the ad begins: “Mark Zuckerberg and Facebook just endorsed Donald Trump for re-election.”

It immediately reveals the deception as it goes on:

You’re probably shocked, and you might be thinking, “how could this possibly be true?”

Well, it’s not. (Sorry.) But what Zuckerberg *has* done is give Donald Trump free rein to lie on his platform—and then to pay Facebook gobs of money to push out their lies to American voters.

Facebook inexplicably used its official news twitter account to challenge Warren, comparing itself to legacy TV broadcasters, which are regulated by the Federal Communications Commission. Facebook, however, is not subject to regulation by the FCC—nor would company leadership particularly want it to be, one assumes.

“You’re making my point here,” Warren responded. “It’s up to you whether you take money to promote lies. You can be in the disinformation-for-profit business, or you can hold yourself to some standards.”

Investigations by The Washington Post, Reuters, and others, meanwhile, show that questionable political advertising by third parties is not only rampant, but also can stay up on Facebook until media attention causes the company to pull it down.

Employees, meanwhile, are reportedly no happier with the contentious policy than anyone else: more than 250 Facebook workers have signed onto an open letter asking the company to adopt new standards for political ads.

https://arstechnica.com/?p=1593859

The Nuclear Power Corporation of India Limited (NPCIL) has acknowledged today that malware attributed by others to North Korean state actors had been found on the administrative network of the Kudankulam Nuclear Power Plant (KKNPP). The admission comes a day after the company issued a denial that any attack would affect the plant’s control systems.

In a press release today, NPCIL Associate Director A. K. Nema stated, “Identification of malware in NPCIL system is correct. The matter was conveyed by CERT-In [India’s national computer emergency response team] when it was noticed by them on September 4, 2019.”

That matches the date threat analyst Pukhraj Singh said he reported information on the breach to India’s National Cyber Security Coordinator.

“The matter was immediately investigated by [India Department of Atomic Energy] specialists,” Nema stated in the release. “The investigation revealed that the infected PC belonged to a user who was connected to the Internet connected network used for administrative purposes. This is isolated from the critical internal network. The networks are being continuously monitored.”

Lazarus in the house

It’s not clear if data was stolen from the KKNPP network. But the nuclear power plant was not the only facility Singh reported being compromised. When asked by Ars why he called the malware attack a “casus belli”—an act of war—Singh, a former analyst for India’s National Technical Research Organization (NTRO), said, “It was because of the second target, which I can’t disclose as of now.”

The malware in question, named Dtrack by Russian malware protection company Kaspersky, has been used in widespread attacks against financial and research centers, based on Kaspersky data collected from over 180 samples of the malware. Dtrack shares elements of code from other malware attributed to the Lazarus threat group, which, according to US Justice Department indictments, is a North Korean state-sponsored hacking operation. Another version of the malware, ATMDtrack, has been used to steal data from ATM networks in India.

DTrack appears to be an espionage and reconnaissance tool, gathering data about infected systems and capable of logging keystrokes, scanning connected networks, and monitoring active processes on infected computers. The malware may have been delivered by an “in-memory implant,” Singh said, though he added that he is waiting for confirmation from other sources. He added that he had not seen any data indicating whether data had been stolen from the KKNPP network. “I didn’t have the full indicators,” Singh said.

While the attack may not have given direct access to nuclear power control networks, it could have been part of an effort to establish a persistent presence on the nuclear plant’s networks. As a paper published in May by the International Committee of the Red Cross on the human cost of cyber operations pointed out, “the majority of the computer devices in the world are only one or two steps away from a trusted system that a determined attacker could compromise.” Lukasz Olejnik, a security researcher who co-authored the paper, noted that “preemptive compromise of trusted systems would make attacks significantly easier,” and that establishing a persistent presence on a network could aid in things such as supply-chain attacks—attempts to use software update processes or other potential opportunities to move to isolated networks to deliver an attack in the future.

That’s similar to the route demonstrated by Stuxnet, the malware attributed to US and Israeli intelligence that managed to jump an “air gap” into Iranian nuclear enrichment equipment controls. While the administrative network of KKNPP was likely not a good route for such an attack given standards for nuclear control systems security, it certainly could provide information about maintenance operations that would be useful for espionage—or for a future attempted cyber-attack.

https://arstechnica.com/?p=1593755