It’s been nearly a year since 3D-printed firearms activist Cody Wilson was arrested for the alleged sexual assault of a female minor. Yesterday, he appeared in an Austin, Texas courtroom and plead guilty to lesser charges that will likely see Wilson register as a sex offender and serve multiple years probation. He won’t be able to possess any firearms and must consent to keystroke/remote monitoring during that time.

But long before Wilson’s plead, his situation quickly prompted an unexpected change in leadership at Defense Distributed, the now-infamous Austin, Texas-based digital printing and firearms company he started in 2012. News of an arrest warrant for Wilson came on September 19, 2018, and Paloma Heindorff was named the company’s new director less than a week later on September 25.

At the time, Heindorff stated that Wilson would no longer have any involvement with the company. She also promised business would continue on as normal and that she would likely take a different approach publicly than her outspoken, interview-friendly predecessor.

Ars called Defense Distributed this week to see if the company would provide an update on things in the year post-Wilson. Could Defense Distributed at least share any updated figures on sales or fundraising from the last year? The last available data on those topics came during Heindorff’s introductory press conference, when she mentioned the Defense Distributed legal fund had eclipsed $400,000 and that the company had sold 3,000 Ghost Gunner milling machines (that, at roughly $1,500 each, would’ve provided about $4.5 million in revenue).

But Stephen Sheftall, who handles sales communication at the company among his duties, said the company had no use for media at this time and wouldn’t be doing any interviews in the foreseeable future. Heindorff, however, has done at least one extended interview since settling into her new role. Back in February, Reason.com sat down with Heindorff about four months into her tenure.

“I’m not going to say it was the best promotion I’ve ever got, but from a business standpoint we’ve done incredibly well—minimal disruptions to the daily operations,” she said. “Cody’s departure has affected us less than people think, and I understand why people would think it would be chaos. He was incredibly powerful figurehead. But there are quite a bit of us working back there. It’s been more of a personal effect than, ‘Oh, now we can’t run the company.’ The company is doing just fine.”

Court cases: One onto appeals, another slowly moves

Even if Defense Distributed hasn’t been doing as much direct press, there have been some notable public happenings involving the company during Heindorff’s first year at the helm. For starters, Defense Distributed has continued its legal efforts revolving around the online distribution of 3D-printed gun CAD files. While several states took action against untraceable, self-milled or printed “ghost guns” in 2018, Defense Distributed brought its own case called Defense Distributed v. Grewal (the attorney general of New Jersey is Gurbir Grewal), which had its day in court back in January. The case centered on a newly enacted state law, SB2465, aimed at regulating “ghost guns” and the promotion or distribution of related files online. Such laws led to Defense Distributed and similar companies taking down gun milling and printing information from their websites. (In Defense Distributed’s case, the company instead continues to offer this info for sale via a USB stick to eligible customers.)

Ultimately, the case was dismissed in February, though the judge made that decision based on jurisdiction rather than the merits of the case. But less than two weeks later, the New Jersey AG revealed one of the documents that led to the case initially being heard had been faked by an IP address in Slovakia.

“It’s really the info they’re trying to stifle, otherwise they would’ve written different laws,” Heindorff told Reason.com when asked to reflect on the state battles around that time. “How disrespectful to one’s subjects, I’ll call them. The general [populace] cannot be trusted with this info.”

After the case’s dismissal, a New Jersey judge eventually also denied Defense Distributed’s motion to seek an injunction (PDF) for the law pending an appeal. As the company revealed on its Legio blog in April, Defense Distributed is now appealing Defense Distributed v. Grewal in the Third Circuit Court of Appeals. Initial filings have been made, but there are no upcoming court dates currently scheduled.

Defense Distributed v. Grewal was not Defense Distributed’s only legal crusade, however. In fact, that was entirely separate from perhaps the more wide-reaching legal case, State of Washington v. Department of State. In this, Washington alongside several other states pursued legal action initially because they believed that, when the Department of Justice settled its five-year legal battle with Defense Distributed in July 2018 and allowed the CAD files in question to be reposted online, that action violated the Constitution. But in a November 2018 filing, government lawyers for the defense explained that rule changes being considered by the State Department at the time would make any legal conflicts in Washington moot.

By February 2019, US District Judge Robert Lasnik got tired of waiting. He denied the Department of State’s motion to stay the case and allowed the proceedings to move forward. The plaintiffs soon filed a motion for summary judgment that month, and the two sides have gone back and forth on timelines and submitting supporting documents in either direction since. One of the defendants’ main arguments, as outlined in a June filing, seems to be the states’ lack of “traceability and redressability”—essentially, the fact that these files are now out there and can’t be taken offline makes this litigation moot in their view. Motions from both sides were delivered by early June, but there is no public timetable for the case’s next steps.

Out of court, pressure from Big Tech and Congress

During Heindorff’s young tenure, Defense Distributed has also faced increased pressure outside of the courts from big tech companies. This summer, Facebook seemed to clarify that “A Page representing a real brick-and-mortar store, legitimate website or brand” could promote 3D-printed firearms “only for sale off of our services and as long as those retailers comply with all applicable laws and regulations.” But currently, Facebook company policy also states that “3D gun printing files or instructions to manufacture firearms using 3D printers or CNC milling machines, including links to websites where such files or instructions are made available, may not be shared by anyone” on Mark Zuckerberg’s giant social media platform. Defense Distributed does not maintain an official brand page on the platform, and private groups that have popped up for Defense Distributed customers typically explicitly ask members to avoid posting “DEFCAD OR OTHER LINKS!”

Other social media sites cracked down on distribution of 3D printed gun files and information this summer as well. Just weeks after the nonprofit gun violence news outlet The Trace found Twitter users freely distributing 3D-printed gun design files, Twitter introduced a new policy banning such actions entirely in June. And on reddit, a longtime subreddit devoted to Defense Distributed, r/defense_distributed, was banned for violating that site’s rules about posting prohibited goods or services.

“Facebook won’t allow anyone to share any links to our products. On YouTube, if videos reference Defcad codes, they get removed. These corporations are saying knowledge of this knowledge is too dangerous for people to have,” Heindorff told Reason.com several months before this summer’s social media saga. “The plans for this gun were downloaded a million times five years ago, but apparently the knowledge this even exists is too dangerous to talk about. That’s crazy to me.”

As The Trace reported, such bans haven’t stopped the spread of 3D-printed gun information. Users wanting to discuss and swap information about 3D-printed firearms simply took their discourse elsewhere. On Keybase, a platform from dating site OkCupid that has end-to-end encryption, expiring messages, and the option for users to verify their identities through social media accounts, a group called Deterrence Dispensed quickly rose into the top 10 most popular Keybase teams within two weeks of the reddit ban. Entire platforms have sprung up to fill similar voids elsewhere: GunStreamer has become a gun-focused video site; Spee.ch is a blockchain-based media site where Deterrence Dispensed has made blueprints available for things like AR-15s and handgun frames.

But things may only get trickier for Defense Distributed and 3D-printed gun advocates from here. States such as New York and Washington have taken New Jersey’s lead and passed their own legislation addressing 3D-printed guns in recent weeks. And some politicians at the federal level also continue to call for bans on 3D-printed guns.

Congressman Ted Deutsch (D-Fla.) and Senator Ed Markey (D-Mass.) put forth the 3D Printed Gun Safety Act of 2019 in late June as the latest example. If eventually made into law, the bill would make it illegal to “intentionally distribute, over the Internet or by means of the World Wide Web, digital instructions in the form of Computer Aided Design files or other code that can automatically program a three-dimensional printer or similar device to produce a firearm or complete a firearm from an unfinished frame or receiver.” So far, however, there hasn’t been any formal movement and this proposal remains one of 110 gun bills Congress currently has on the table.

Listing image by Defense Distributed

https://arstechnica.com/?p=1528945

One of Ajit Pai’s attempts to eliminate regulation of 5G deployment has been overturned by federal judges.

The Federal Communications Commission last year approved an order that “exempted most small cell construction from two kinds of previously required review: historic-preservation review under the National Historic Preservation Act (NHPA) and environmental review under the National Environmental Policy Act (NEPA),” federal judges said in their decision partially overturning the order.

The FCC claimed its deregulation of small cells was necessary to spur deployment of 5G wireless networks. But the commission was sued by the United Keetoowah Band of Cherokee Indians in Oklahoma, the Blackfeet Tribe, and the Natural Resources Defense Council (NRDC). The FCC order was of particular interest to tribal groups because it affected construction on “sites of religious and cultural importance to federally recognized Indian Tribes,” the judges noted. “The Order also effectively reduced Tribes’ role in reviewing proposed construction of macrocell towers and other wireless facilities that remain subject to cultural and environmental review.”

The FCC’s opponents argued that the elimination of historic-preservation and environmental review was arbitrary and capricious, that it violated both the NHPA and NEPA, and that the changes to tribes’ role in reviewing construction was arbitrary and capricious. A three-judge panel of the US Court of Appeals for the District of Columbia Circuit issued its unanimous ruling today.

Judges wrote that Pai’s order “does not justify the Commission’s determination that it was not in the public interest to require review of small cell deployments. In particular, the Commission failed to justify its confidence that small cell deployments pose little to no cognizable religious, cultural, or environmental risk, particularly given the vast number of proposed deployments and the reality that the Order will principally affect small cells that require new construction.”

The FCC also failed to “adequately address possible harms of deregulation and benefits of environmental and historic-preservation review,” which means the commission’s “deregulation of small cells is thus arbitrary and capricious,” judges concluded.

The judges did not vacate the FCC order in its entirety, and they remanded some remaining issues back to the commission.

“Today’s decision confirms that the FCC cannot just scream ‘5G’ to justify ignoring its duties to tribal nations and to the environment,” attorney Andrew Jay Schwartzman, who helped oppose the FCC order, said today. “The decision does give the FCC more latitude than we would prefer on some of the mechanisms for tribal review, but we will deal with that on the remand.”

Separately, the Pai FCC’s attempt to take certain Lifeline broadband subsidies away from tribal residents was overturned by the same court in February this year.

“Back to the drawing board”

Last year’s FCC vote on the small cell order was 3-2, with both Democrats dissenting. FCC Democrat Jessica Rosenworcel hailed the judges’ ruling today, writing that “the court just vacated a large part of the FCC’s 5G deployment strategy” and that “it’s time to go back to the drawing board and do better.”

Brendan Carr, an FCC Republican, put a positive spin on the ruling, saying it “upheld key provisions.” Carr wrote:

Most importantly, the court affirmed our decision that parties cannot demand upfront fees before reviewing any cell sites, large or small. These fees, which had grown exponentially in the last few years, created incentives for frivolous reviews unrelated to any potential impact on historic sites. Those financial incentives are gone, and we expect our fee restrictions to continue greatly diminishing unnecessary and costly delays. I’m also pleased that the court affirmed our accelerated timelines for reviews. Already, these reforms have resulted in significant new builds.

As for the judges remanding parts of the order back to the FCC, Carr said, “We are reviewing the portion of last March’s decision that the DC Circuit did not affirm and look forward to next steps, as appropriate.”

Carr’s statement also claimed that the FCC’s deregulatory moves “have enabled the US to leapfrog our global competitors and secure the largest 5G build in the world.”

But FCC changes haven’t had the impact that Carr claims. Another FCC order last year eliminated $2 billion worth of local fees charged to carriers for deployment of small cells on public rights-of-way. Carr had claimed that this decision was needed to boost 5G construction, but Verizon said that the FCC decision did nothing to speed up its deployment. Cities are suing the FCC to overturn that order.

https://arstechnica.com/?p=1549339

The Trump administration seems determined to take action concerning its irritation with social media networks’ supposed bias against right-wing speech, as the White House is reportedly drafting an executive order directing agencies to do something about it.

Politico reported earlier this week that the White House was circulating drafts of a proposed order, but the site couldn’t get anyone to describe what was in this document. Today, however, CNN says it has seen a summary of the draft executive order.

The current draft, called “Protecting Americans from Online Censorship,” would put the burden of Internet content management on the Federal Communications Commission, calling on the agency—which has never before dealt with regulation of online content—to develop regulations clarifying under what circumstances social media platforms are protected by the law when moderating content. It also says the Federal Trade Commission should consider whatever policies the FCC comes up with when it investigates companies for not adhering to their stated policies.

The summary says the administration received 15,000 anecdotal complaints about online censorship from the online form it launched in May asking for user reports, and the White House offers to share those complaints with the FTC for a public complaint docket. The most recent high-profile right-wing censorship complaint was resolved earlier today, when Twitter, under significant pressure, reversed course on allowing the campaign account for Sen. Majority Leader Mitch McConnell to share a video showing “abusive behavior” on the part of protestors.

Trump last month held a social media event at the White House, and he railed against the “tremendous dishonesty, bias, discrimination, and suppression practiced by” platforms such as Twitter, Facebook, and YouTube. “We will not let them get away with it much longer,” he said at the time.

The platforms’ supposed silencing of conservative voices is “disgraceful,” added the president, whose personal Twitter account has about 63 million followers.

The White House, the FTC, and the FCC all declined to comment to CNN on the draft summary, which is a long way yet from being any kind of official order. FCC commissioner Jessica Rosenworcel, however, tweeted out a link to the CNN story with the one-word commentary: “What.”

https://arstechnica.com/?p=1549243

After a day of blistering criticism from Republicans, Twitter has reversed an earlier decision and restored the campaign account of Senate Majority Leader Mitch McConnell. His account had been frozen after tweeting out a video showing several protestors shouting violent threats against McConnell outside the senator’s Kentucky home.

Twitter’s rules ban anyone from posting videos that contain violence or threats of violence. The video in question included several apparent threats against McConnell, including a woman shouting “just stab the motherfucker in the heart please.”

But weirdly, Twitter’s policies don’t draw distinctions based on the purpose or context of a posted video. A threatening video posted by someone making the threat is treated the same way as a video posted by the target of threatening remarks.

Twitter stood by its decision even after the McConnell campaign pointed out the absurdity of penalizing the target of violent threats for posting a video of them. “The users were temporarily locked out of their accounts for a Tweet that violated our violent threats policy, specifically threats involving physical safety,” Twitter said in a Thursday afternoon email to Ars.

Republicans pounced on Twitter’s decision, portraying it as the latest example of anti-conservative bias among major technology companies. Republican campaign committees in both the House and Senate vowed to freeze ad spending on Twitter’s platform until Twitter restored McConnell’s account.

It didn’t take long for Twitter reverse course.

“Several Twitter users, including US Senate Majority Leader Mitch McConnell’s campaign account, were temporarily locked out of their accounts for Tweeting a video that violated our abusive behavior policy,” Twitter tweeted on Friday. “After multiple appeals from affected users and Leader McConnell’s team confirming their intent to highlight the threats for public discussion, we have reviewed this case more closely.”

“Going forward, the video will be visible on the service with a sensitive media interstitial and only in cases where the Tweet content does not otherwise violate the Twitter Rules,” the company announced.

https://arstechnica.com/?p=1549251

A small library that lends out mobile hotspots is facing a tough budget decision because one of its borrowers accidentally ran up $880 in roaming fees, and Verizon refuses to waive or reduce the charges. The library has an “unlimited” data plan for the hotspots, but Verizon says it has to pay the $880 to cover less than half a gigabyte of data usage that happened across the border with Canada.

Tully Free Library in Tully, New York, a town of fewer than 3,000 people, lends out three Verizon hotspots to a rural population that has limited Internet access. The library started the hotspot-lending program with a grant from the Central New York Library Resources Council, which paid the bill for two years. Crucially, the service plan with Verizon blocked international roaming so that library borrowers wouldn’t rack up unintentional charges if they happened to cross the Canadian border.

But when the grant ran out, Tully Free Library had to get a new contract and service plan, and the organization began paying the bill itself. The new plan seemed to be identical to the old one, but it enabled international roaming.

“They never said to us, ‘Do you want international roaming blocked?'” Tully Free Library Director Annabeth Hayes told Ars. “That wasn’t something that occurred to me because it was blocked before.”

$880 for 440 megabytes

One day, a library borrower had a hotspot in his car when he made a long drive that took him through Canada for a few hours.

“I think he said he was taking his brother to the airport. We’re in the middle of the state so we’re pretty much two hours from Canada… He was only over the border for about four hours and he said he wasn’t even using the hotspot,” Hayes said. “It was just on in the car and apparently it was pinging a tower so that tower was incurring all these fees.”

We don’t know exactly what the data usage consisted of, but perhaps the borrower had one of his devices connected to the hotspot and it did some automatic updates. In any case, the library’s next bill from Verizon included an $880.33 charge for about 440MB of international data. Until that bill came, Hayes didn’t realize that international roaming wasn’t blocked on the new plan.

Hayes called Verizon and was able to get international roaming blocked going forward, but the library hasn’t been able to convince the company to waive the bill or even reduce the charge.

“I ended up contacting their executive communications department, and the person there said she had to contact their legal team because our contract was under the government/educational department,” Hayes said. “She contacted the legal team and they went back and forth and finally decided that no, we couldn’t have our fee waived.”

On Friday last week, a representative of Verizon’s Executive Relations department told Hayes the following in an email that Hayes shared with Ars:

Per our telephone conversation, The Executive Relations Office will not be making the courtesy adjustments for the international data overage accrued in the amount of $880.33. You advised your library allows end-users to remove the devices from your facility and the devices are unrestricted. Without the proper restrictions and provisions in place, this makes your company liable… Thank you for your patience in the resolution of this matter and your continued loyalty to Verizon.

Verizon’s response “was a very legal argument and yes, that’s a correct legal argument,” Hayes said. “But if you know the back story, it seems really unfair.”

We contacted Verizon spokespeople about the Tully billing problem yesterday morning and again today, and we will update this article if we get a response.

Verizon charges $2.05 per megabyte of data usage in Canada on a pay-as-you-go basis. But Verizon also offers a “Monthly International Travel Plan” that allows 100 minutes of voice calls, 100 sent text messages, and half a gigabyte of data usage in Canada and about 185 other countries for $70 a month. A similar plan with more voice and text usage and 2GB a month costs $130. Based on those prices, it seems likely that Verizon could give Tully a sizable refund and still cover its own roaming costs for the 440MB.

Charge is 55% of library’s hotspot budget

But for the Tully Free Library, $880 is a lot—about 55% of the library’s annual hotspot budget, Hayes said. Generally, the library pays $40 a month for each of the three hotspots, for a total of $120 a month. Between the regular charges and the unexpected roaming fee, the latest bill came to $1,000.

“I don’t think we would just say, ‘OK, that’s it, we’re not going to have any hotspots,'” Hayes said when asked how the library will handle the budget problem. “We know how important it is to people. We would have to cut in another area, either materials or programming.” Most of the library’s $200,000 total annual budget comes from local taxes, and the rest from grants and donations, she said.

The hotspots are important because of how limited home Internet access is in the area. People take advantage of the free Wi-Fi available at the library and a McDonald’s about seven miles away. Hayes sometimes “finds people camped out in her parking lot on laptops, logged onto the library’s free Wi-Fi” when she arrives for work in the morning, a Syracuse Post-Standard article in April said. But the hotspots let people temporarily get online at home.

“A lot of the Internet providers simply won’t run lines down certain roads, they’ll go halfway and they decide there aren’t enough people who live down that road, so we’re not going to go down there,” Hayes said. “We get a lot of people who either don’t have Internet at home because they can’t afford it or it just simply doesn’t reach to their house… we have a waiting list for the hotspots and it’s been a really popular item to borrow at the library.”

“Unlimited data” capped at 25GB

Aside from the roaming bill, Hayes is facing another new problem with Verizon. The hotspot data plans seemed to be truly unlimited when the regional library council paid for them, allowing borrowers to stream video or do other data-heavy activities. But since the plan changeover, Verizon has capped their data at 25GB a month, even though the new plan seemed to be identical to the old one, Hayes said.

The bill Hayes showed us describes their hotspot plan as “unlimited monthly gigabytes.” But once the hotspots hit 25GB, they become unusable, Hayes said. The restriction seems to be similar to one Verizon imposed on the Santa Clara County fire department during a wildfire response in 2018.

“Now we have to tell patrons, ‘You can’t stream anything, you can just visit websites and do your email and stuff like that,'” Hayes said.

The bill with the $880 in roaming charges was due on August 2, but the library hasn’t paid it yet. “Verizon told us not to pay it while they were figuring out if they were going to waive it or not so we have not paid it yet,” Hayes said. She hasn’t given up on her attempts to get the roaming fee waived.

“I think we still have a month or so to try to figure out what to do,” she said. “I don’t know what we’re going to do if we can’t get them to change their mind… I’m kind of assuming that they will eventually, I just need to get them to see that they were wrong.”

https://arstechnica.com/?p=1549139

Around 80 Amazon warehouse workers in the Twin Cities suburb of Eagan, Minnesota staged a two-hour walkout on Thursday morning. It’s the latest in a series of strikes and protests spearheaded by Amazon workers in the state.

Last month, a few dozen workers at another Amazon facility in Shakopee, Minnesota walked off the job on Prime Day—a massive sale that is one of Amazon’s busiest days of the year. A December protest in Shakopee attracted 250 people.

Workers in Shakopee were demanding better pay and working conditions. The Eagan protests were more specific: workers were upset that Amazon wasn’t providing enough parking for its workers. One worker told Gizmodo that some workers showed up more than an hour early in order to get a spot.

Workers were forced to double park in order to squeeze their cars in. This sometimes blocked Amazon delivery vehicles in the process. Amazon began towing worker vehicles, fining their owners as much as $350—which could be several days of pay for a part-time warehouse worker.

Outrage over the parking situation finally sparked yesterday’s walkout. And the protests worked. According to CNET, Amazon has promised to “repay employees for towing their cars, provide more parking, and recognize the upcoming Eid holiday for Muslim employees.”

“We have been working to support the site, including providing onsite parking, offsite parking and shuttles,” an Amazon spokesperson told Ars. “We’re committed to listening to our teams.”

Amazon has long resisted organizing efforts at its warehouses

The larger question looming over Amazon is whether its workers in Minnesota or elsewhere could form a union and collectively bargain with the company. Unsurprisingly, Amazon is not a fan of that idea.

“We are not anti-union, but we are not neutral either,” Amazon says in a training video for managers that was leaked last year. “We will boldly defend our direct relationship with associates as best for the associates, the business, and our shareholders.”

Earlier this year, Amazon fired a worker involved in efforts to organize an Amazon facility on New York’s Staten Island—though Amazon says his firing was unrelated to his organizing efforts.

Amazon’s efforts to discourage worker organizing have been effective. Strikes and other organized worker activities have been rare at most of Amazon’s US facilities. But the Twin Cities is emerging as a hotbed of worker activism.

The Twin Cities are home to tens of thousands of Somali immigrants who provide a significant portion of the workforce in Amazon’s Minnesota warehouses. A group called the Awood Center has been organizing Somali workers and encouraging them to challenge Amazon on its labor practices.

Beyond general pay and benefit concerns, Muslim workers have accused Amazon of doing too little to accommodate religious practices. A 2017 protest at a Seattle facility faulted Amazon for failing to provide Muslim workers with prayer space to use during work breaks.

The big question for Amazon is whether the Minnesota protests will inspire similar actions at other facilities around the country. Last year, Amazon set a new company-wide minimum wage of $15 an hour in a bid to improve worker morale.

https://arstechnica.com/?p=1548965

A security consultant who took to Twitter to call out inappropriate comments made by a Southwest Airline flight attendant received a surprising response when the airline’s official Twitter account included her flight number in its reply while the flight had yet to take off.

The consultant, peeved that the airline tracked down her real-world identity and then broadcast her location, sent a follow-up saying the number amounted to personally identifiable information that the airline was obligated to keep private. The airline’s response: flight numbers aren’t PII. The conversation started out with a tweets like this one, reporting that an attendant on the flight she was boarding was making jokes some passengers found to be offensive:

Forgive me because I don’t often fly this airline, but are there boundaries around jokes made by FAs or is that totally at their discretion?@SouthwestAir

— Jackie (@find_evil) August 8, 2019

A Southwest representative using the name Emilia responded with this:

While Southwest Airlines Employees are encouraged to express their creativity and unique personalities when performing their job duties, they should also use good judgment, meet all Safety requirements, and maintain an astute regard for the comfort (1/2) -Emilia

— Southwest Airlines (@SouthwestAir) August 8, 2019

In a follow-up that wasn’t deleted until after Ars asked Southwest for comment, Emilia went on to include the flight number of the plane the consultant was boarding. The now apoplectic consultant responded with this:

Did you just drop my fucking flight number to the world????????

We haven’t even taken off, why would you do this? I haven’t even DMed you! You just dropped my PII pic.twitter.com/dBq1CvHWZl

— Jackie (@find_evil) August 8, 2019

Emilia sent a response that has also now been deleted that insisted flight numbers aren’t PII. Emilia also reminded the consultant that she was “welcome to reach out to us privately in the future if you do not wish to discuss your travel publicly.”

The consultant, who identified herself as Jackie Singh, told Ars that a few days earlier, she had used Twitter to commend the service provided by another Southwest agent. In a direct message, a Southwest representative had asked Singh for her flight confirmation number. Singh told Ars that she believes Emilia used that previous interaction to tie Singh’s Twitter account to her real-world identity. And with that, Emilia tracked and then tweeted the flight number of the plane Singh was boarding.

A variety of onlookers came to Singh’s defense by trying to explain to Emilia how broadcasting the flight number of a plane a passenger was boarding allowed others to know Singh’s location. And for some passengers, this might pose a threat. One onlooker even posted this image showing Sing’s real-time location:

evil_found pic.twitter.com/WaxIvTNuhM

— Neural Netmork (@starsprout) August 8, 2019

Ars asked Southwest if it was standard policy for representatives to tweet flight numbers of its passengers. More than four hours later, a company official wrote:

The Safety and personal comfort of our Employees and Customers is always our top priority, and that includes protecting their right to privacy. Our Team is equipped to respond to Customer inquiries on social media and is trained on handling sensitive Customer data, and they are coached to proactively gather relevant information to understand our Customers’ need and quickly resolve their issue and provide an individualized and personal response. It is not our policy to publicly share personally identifiable information about our Employees or our Customers. We have reached out to the Customer to express our apologies and regret over their disappointment, and we look forward to the opportunity to resolve this issue.

But at the time Ars received the statement, Singh had yet to receive any communication from Southwest. It was only after Ars followed up with the representative and asked if the representative was sure an apology was sent that Singh received a DM from Southwest. It read:

Hello Jackie, my name is Colin and I work in Customer Relations here at Southwest Airlines. I wanted to reach out and apologize for the interaction you had last night regarding your flight with us and the subsequent public post from us outlining your flight number. Our Social Care Team is equipped to respond to Customer inquiries on social media and is trained on handling sensitive Customer data, and we are coached to proactively gather relevant information to understand our Customers’ need and quickly resolve their issue. I can definitely understand where your frustration came from as you had not posted your flight number publicly prior to our reply to your complaint. I sincerely apologize for this experience, we hope to see you onboard again soon. -Colin

The Southwest representative never responded to a question asking if the company planned to train employees not to drop flight numbers of other private passenger information in social media.

https://arstechnica.com/?p=1548757

AUSTIN, Texas—This morning, almost one year after an initial warrant for his arrest went out, Cody Wilson stood stoically in front of Judge Brad Urrutia in the 450th Criminal District Court in Travis County as cameras and a packed gallery watched. The founder and former director of firearms technology company Defense Distributed soon pleaded guilty to lesser charges stemming from an August 2018 incident with a female minor.

Sporting a dark grey suit, Wilson’s previously defiant public persona was nowhere to be found. Instead, the entire appearance proceeded matter of factly, and it was an event of few words. Judge Urrutia read the charge changes and went over the situation with Wilson and his attorneys; Wilson’s team would respond briefly with “Yes, your honor.” Wilson arrived early alongside his attorneys, but within approximately a half hour it was all over. A plead had been entered, and his team left the room as video cameras trailed behind.

Prior to appearing in court, Wilson and his attorneys, F. Andino Reynal and Joseph Turner, bargained with the state of Texas to amend charges against the 3D-printed gun activist. Instead of sexual assault, Wilson stood accused of injury to a child, a lesser felony than what he originally faced. His guilty plea this morning now comes with a recommended seven-year probation period during which Wilson must register as a sex offender.

Wilson’s formal sentencing has been scheduled for September 12. Should the plead be accepted by Judge Urrutia as anticipated, Wilson will avoid prison in favor of that multi-year probation. As the Austin-Statesman American reported, Wilson forfeited his personal firearms last year when he was released from jail on bond. Under the terms of his probation, he would not be able to own a gun during that period.

What brought Wilson to court today

According to court documents, authorities believed Wilson solicited the underage girl from a website called SugarDaddyMeet.com and eventually engaged in sexual acts with her on August 15, 2018. News of the arrest warrant for Wilson broke about a month late as he was out of the country in Taiwan. He seemed to be evading capture by posing as a US college student, but authorities in the US and Taipei eventually collaborated to apprehend Wilson and bring him back to the US.

In December 2018, the State of Texas finally formally indicted (PDF) Wilson on multiple charges: four counts of sexual assault of a child, two charges of indecency with a child by contact, and two charges of indecency with a child by exposure. The charges were all second-degree felonies punishable by up to 20 years in prison and fines of up to $10,000. Those charges were lessened prior to this morning’s initial court appearance.

In his original five-page affidavit (PDF), Austin Police Department detective Shaun Donovan outlined the initial evidence against Wilson from the night in question. It included surveillance videos from what is believed to be a coffee shop rendezvous point and the hotel where the incident reportedly took place. Police found a Black Ford Edge SUV in these videos registered to Defense Distributed. Later, they obtained “digital valet receipts” from the hotel showing the SUV was returned to Wilson later that night. Police also discovered hotel records pinpointing Wilson as the lone registered guest for the room in question on the night of the alleged incident.

Subsequent warrants only gathered more information. The first (PDF) wanted all stored files about the Sanjuro account from SugarDaddyMeet, including things like images, file transfers, Web access logs, credit and billing information, IP addresses, and more. A second warrant (PDF) focused on Apple, asking for device and account information for Wilson’s iPhone, photos and videos stored to his iCloud account, and iMessage and SMS messages between Wilson and the girl. And a third warrant (PDF) asked for permission to seize photo evidence of Wilson’s groin and upper leg area, since the alleged victim initially told authorities she and Wilson exchanged nude photos and the affidavit states Wilson has a “uniquely identifiable skin condition.”

As Austin-American Statesman criminal reporter Ryan Autullo reported, Wilson’s lawyers had been insisting Wilson did not know the girl was underage. SugarDaddyMeet requires users to check a box stating they are 18, but Texas law puts it on the adult to verify the age of consent (which is 17 in the state).

This is a developing story. Ars will be updating it as new information becomes available.

Listing image by Nathan Mattise

https://arstechnica.com/?p=1548919

I traveled to Mexico City last week to have a relaxing vacation with my wife—not to find stories for Ars Technica. But our Airbnb apartment happened to be around the corner from a bar called Bitcoin Embassy. How could I not check it out?

The bar included a bitcoin ATM that lets users trade physical cash for bitcoins, and vice versa (there are more than 5,000 bitcoin ATMs like this around the world). Bitcoin Embassy offered a 10% discount if I paid for my tab in bitcoin.

So I inserted a 500 peso note—about $25—into the machine. I downloaded a bitcoin wallet app from Google’s Play Store to my Pixel smartphone. It generated an address for receiving the funds and displayed it as a QR code the ATM could scan. A few second later, the ATM spit out a receipt stating “Bitcoin purchased: 0.00245589.”

There was just one problem: my wallet app didn’t show any bitcoins being received. We sat down at the bar and ordered drinks and a pizza while we waited for the bitcoins to arrive.

By the time we’d finished our food, my app still showed a bitcoin balance of 0. The receipt showed the bitcoin address where the funds were supposed to be sent—bc1q7ayu350m8rntrw2uvewudrhqe5gj7d8d9ndggv—and I double-checked to make sure this address matched the one in my wallet. It did. But no bitcoins.

So we gave up and paid with a conventional credit card.

After leaving the bar, I sent off an email to the support address listed on my receipt. The next morning, I got a response: “Transactions under [1,000 pesos] are taking a day to two, in the course of today they will reach the wallet.” I finally got my bitcoins around 6pm.

I feel a little bad for leading with this anecdote. Everything else about the bar was great. It had good food, friendly service, and a classy—if nerdy—aesthetic. I’d probably visit regularly if it were in my neighborhood.

But ultimately this is a “you had one job” situation. The point of a bitcoin bar is to showcase the advantages of bitcoin—and that was the one part of the experience that didn’t go well.

My experience at Bitcoin Embassy epitomizes the state of the larger bitcoin world. The fact that people continue to start businesses like Mexico City’s Bitcoin Embassy demonstrates that there’s still plenty of enthusiasm for the virtual currency, even after last year’s crash in bitcoin’s price. Yet the experience of using bitcoins to actually pay for things—supposedly its main application—remains rather rocky.

The story of Bitcoin Embassy

Before leaving the bar, I got contact information for General Manager Lorena Ortiz. She responded almost instantly on WhatsApp and agreed to meet me at the bar at 5pm the next day. She’s charming, with accented but excellent English.

“I’m kind of a punk and metal fan, so the ideology behind bitcoin was really appealing to me,” Ortiz told me as we sat at Bitcoin Embassy Bar.

Ortiz is the co-owner of the bar along with her boyfriend, David Noriega, an entrepreneur who owns a chain of comic book shops. Ortiz is a relative newcomer to the technology, dating back to 2017. But she told me that Noriega has been involved in bitcoin since around 2011. He operates a network of bitcoin ATMs inside his comic book shops—and now Bitcoin Embassy Bar—and hopes to add ATMs to other businesses in the near future.

Noriega had long dreamed of opening a bitcoin-themed coffee shop—something that has become fairly common around the world. “I told him we can do it together if you want to,” Ortiz said. But she suggested changing the concept from a coffee shop to a bar.

The couple signed a lease in December 2018 and spent about four months renovating the space. The results are gorgeous.

A monitor mounted over the bar shows the price of bitcoin and other cryptocurrencies in real time. A large glass case behind the bar offers bitcoin merchandise for sale. I bought a Bitcoin Embassy T-shirt. And, of course, there was a bitcoin ATM along one wall.

Ortiz told me that my delayed bitcoin payout was unusual. Customers trying to cash in their bitcoins for pesos typically have to wait for 10 or 15 minutes for the transaction to be accepted by the bitcoin blockchain. She said she hadn’t heard of customers suffering long delays buying bitcoins.

And she insisted that, once I had my bitcoins, the purchasing process would have been simple. She demonstrated how the payment would have worked with her own smartphone. The bar’s point-of-sale system generated an electronic invoice and displayed a QR code on its screen. Ortiz pointed her smartphone at it and the transaction cleared in a few seconds.

The bitcoin world is still searching for its killer app

On the one hand, there’s no denying the continued vitality of the bitcoin community. There are a number of other establishments called “bitcoin embassy,” from Poland to Australia. Most are co-working facilities rather than bars, but clearly Ortiz and Noriega are just two of many people around the world who are inspired by the bitcoin vision.

At the same time, practical applications remain elusive 10 years after bitcoin’s creation. The bar regularly hosts meet-up events for the bitcoin community, so I asked Ortiz how people were using bitcoin in Mexico and across Latin America. She quickly rattled off examples of people creating new blockchains for various purposes—from storing medical data to uniquely signing art.

But when I asked for examples of people making practical uses of bitcoins specifically, she had a tougher time coming up with examples. A lot of people have talked about using bitcoin for remittances as an alternative to companies MoneyGram and Western Union. But Ortiz said she hadn’t heard of many people doing this.

She told me the chef who designed Bitcoin Embassy’s menus asked Ortiz about using bitcoin to send money from overseas back to his family in Mexico. She explained the technology and walked him through the process. However, she said, “He couldn’t understand very well, so he hasn’t done it yet.”

One of the bar’s Mezcal suppliers has asked Ortiz about using bitcoin to accept payments when exporting its product. However, she said, “I haven’t heard of anyone that uses it that way.”

She said she had heard of an Indian bitcoin payments company that was using bitcoin to pay its employees in Mexico.

Does Bitcoin Embassy pay its employees in bitcoin?

“I always tell them I can pay you in bitcoin if you want to, but they don’t want to,” Ortiz says.

Of course, it’s not uncommon for new technologies to start out as toys for elite nerds before they mature into mass-market appeal. The first PCs in the 1970s seemed useless to the average consumer, and the Internet of the 1980s was hardly user-friendly.

But visiting this Mexico City bar, I was struck by how little things have changed since I started covering the technology in 2011. Over the last eight years, the bitcoin community—and bitcoin’s price—has grown by orders of magnitude. The bitcoin economy has much more sophisticated infrastructure for storing and trading bitcoins. But practical applications for bitcoin—beyond trading it, holding it, and hoping to get rich—seem almost as elusive today as they were eight years ago.

https://arstechnica.com/?p=1546143

A Pakistani man bribed AT&T call-center employees to install malware and unauthorized hardware as part of a scheme to fraudulently unlock cell phones, according to the US Department of Justice. Muhammad Fahd, 34, was extradited from Hong Kong to the US on Friday and is being detained pending trial.

An indictment alleges that “Fahd recruited and paid AT&T insiders to use their computer credentials and access to disable AT&T’s proprietary locking software that prevented ineligible phones from being removed from AT&T’s network,” a DOJ announcement yesterday said. “The scheme resulted in millions of phones being removed from AT&T service and/or payment plans, costing the company millions of dollars. Fahd allegedly paid the insiders hundreds of thousands of dollars—paying one co-conspirator $428,500 over the five-year scheme.”

In all, AT&T insiders received more than $1 million in bribes from Fahd and his co-conspirators, who fraudulently unlocked more than 2 million cell phones, the government alleged. Three former AT&T customer service reps from a call center in Bothell, Washington, already pleaded guilty and agreed to pay the money back to AT&T.

The first indictment against Fahd was filed in November 2017, and he was arrested in Hong Kong at the request of the United States in February 2018, but the case was just unsealed yesterday. Fahd is facing 14 charges in US District Court for the Western District of Washington. The charges are conspiracy to commit wire fraud, conspiracy to violate the Travel Act and the Computer Fraud and Abuse Act, four counts of wire fraud, two counts of accessing a protected computer in furtherance of fraud, two counts of intentional damage to a protected computer, and four counts of violating the Travel Act.

AT&T generally locks phones to its network, preventing them from being used with other carriers. AT&T grants customers’ unlock requests after they’ve paid off their contracts or device installment plans.

If a phone is unlocked before it has been paid off, resulting in a customer switching to another carrier, AT&T might not be able to collect the rest of the payments, a DOJ indictment of Fahd noted.

“Unlocked phones were a valuable commodity because they could be resold and used on any other compatible network around the world… When phones were unlocked fraudulently without AT&T’s authorization and customers switched service to other carriers, the fraudulent transactions deprived AT&T of the stream of payments that were due under the service contracts and installment plans,” the indictment said.

The alleged conspiracy involved “the installation of malware and unauthorized hardware on AT&T’s internal network,” which Fahd and co-conspirators used to sell fraudulent phone-unlocking services to the general public, the indictment said.

Former AT&T workers pleaded guilty

Three now-former AT&T employees cooperated with the government and pleaded guilty to charges related to the conspiracy, and they are expected to testify at trial against Fahd, a court document said. Their names are Kyra Evans, DeVaughn Woods, and Marc Sapatin. All three agreed to pay financial penalties that will be transferred to AT&T, but they could also face prison time after their November 1 sentencing hearings.

Sapatin agreed to pay $441,500 in an October 2018 plea agreement. Evans agreed to pay restitution of $280,200, and Woods agreed to pay $155,032.

“We have been working closely with law enforcement since this scheme was uncovered to bring these criminals to justice and are pleased with these developments,” AT&T told Ars.

We asked AT&T if it made any security improvements to prevent this from happening again, but we did not receive an answer. An AT&T spokesperson said that the scheme did not result in improper access to customer information.

The DOJ also charged Ghulam Jiwani, one of Fahd’s alleged co-conspirators. Jiwani was arrested in Hong Kong, “but died prior to being transferred to United States custody,” a court document said. The charges against him were dropped as a result of his death.

Fahd and Jiwani had other co-conspirators “known and unknown to the Grand Jury,” the indictment said.

Evans, Woods, and Sapatin apparently were not the only AT&T employees who allegedly were involved in the scheme. The DOJ alleges that “between 2012 and 2017, Fahd recruited various AT&T employees to the conspiracy. Some early recruits were paid to identify other employees who could be bribed and convinced to join the scheme. So far, three of those co-conspirators have pleaded guilty admitting they were paid thousands of dollars for facilitating Fahd’s fraudulent scheme.”

Fahd and his co-conspirators instructed AT&T employees “to create shell companies and open business banking accounts in the names of the shell companies” in order to receive their bribes, the indictment said.

More details from the indictment

The scheme began in April 2012 when Fahd and his co-conspirators gave the bribed AT&T employees “instructions… including lists of cellular telephone international mobile equipment identity (IMEI) numbers for the insiders to submit for fraudulent and unauthorized unlocking,” the indictment said.

The alleged malware-planting part of the conspiracy began around April 2013. Fahd, Jiwani, and others allegedly “bribed insiders to plant malware on AT&T’s internal protected computers for the purpose of gathering confidential and proprietary information on how AT&T’s computer network and software applications functioned.”

Fahd and his co-conspirators used this information to create “additional malware designed to interact with AT&T’s internal protected computers and process fraudulent and unauthorized unlock requests submitted… from remote servers controlled by members of the conspiracy,” the indictment said.

With this malware, Fahd and his crew were able to “log into AT&T’s internal protected computers under false pretenses and to process fraudulent and unauthorized unlock requests,” the indictment said.

From November 2014 to September 2017, Fahd and others allegedly bribed AT&T insiders “to install unauthorized computer hardware devices, including wireless access points designed to provide the conspiracy with unauthorized access to AT&T’s internal protected computers.” With these hardware devices, Fahd and others “facilitate[d] the automated process of submitting fraudulent and unauthorized unlock requests on behalf of the conspiracy.”

https://arstechnica.com/?p=1546983