Former county clerk Tina Peters sentenced to 9 years for voting-system breach
Tina Peters, a former election official in Colorado’s Mesa County who promoted former President Donald Trump’s election conspiracy theories and was responsible for a breach of voting-system security, was sentenced today to nine years in prison.
“Your lies are well-documented and these convictions are serious,” 21st Judicial District Judge Matthew Barrett told Peters, according to The Colorado Sun. “I am convinced you would do it all over again. You are as defiant a defendant as this court has ever seen.” Barrett said that “prison is the only place” for Peters.
“You are no hero,” Barrett also said, according to Colorado Public Radio. “You’re a charlatan who used, and is still using, your prior position in office to peddle a snake oil that’s been proven to be junk time and time again.”
Peters reportedly will serve 60 days to six months in the Mesa County jail and then be transferred to the state Department of Corrections. “Peters was handcuffed and taken to jail immediately after she was sentenced,” the Sun wrote.
Peters “compromised her own election equipment”
On August 12, “Peters was convicted of three counts of attempting to influence a public servant, one count of conspiracy to commit criminal impersonation, first-degree official misconduct, violation of duty, and failing to comply with the secretary of state,” the Associated Press wrote at the time.
After the conviction, Colorado Secretary of State Jena Griswold said that “Tina Peters willfully compromised her own election equipment trying to prove Trump’s big lie. She has been found guilty by a jury of her peers and will now face the consequences of her actions.”
In October 2021, Peters was barred from supervising elections due to the leak of voting-system BIOS passwords to QAnon conspiracy theorist Ron Watkins. At the time, Mesa County District Court Judge Valerie Robison detailed how Peters brought a man into a meeting on a “trusted build” software update that is meant to ensure a secure chain of custody for the voting system.
Automattic demanded web host pay $32M annually for using WordPress trademark
Automattic Inc. and its founder have been sued by a WordPress hosting company that alleges an extortion scheme to extract payments for use of the trademark for the open source WordPress software. Hosting firm WP Engine sued Automattic and founder Matt Mullenweg in a complaint filed yesterday in US District Court for the Northern District of California.
“This is a case about abuse of power, extortion, and greed,” the lawsuit said. “The misconduct at issue here is all the more shocking because it occurred in an unexpected place—the WordPress open source software community built on promises of the freedom to build, run, change, and redistribute without barriers or constraints, for all.”
The lawsuit alleged that “over the last two weeks, Defendants have been carrying out a scheme to ban WPE from the WordPress community unless it agreed to pay tens of millions of dollars to Automattic for a purported trademark license that WPE does not even need.”
The complaint says that Mullenweg blocked WP Engine “from updating the WordPress plugins that it publishes through wordpress.org,” and “withdrew login credentials for individual employees at WPE, preventing them from logging into their personal accounts to access other wordpress.org resources, including the community Slack channels which are used to coordinate contributions to WordPress Core, the Trac system which allows contributors to propose work to do on WordPress, and the SubVersion system that manages code contributions.”
The lawsuit makes accusations, including libel, slander, and attempted extortion, and demands a jury trial. The lawsuit was filed along with an exhibit that shows Automattic’s demand for payment. A September 23 letter to WP Engine from Automattic’s legal team suggests “a mere 8% royalty” on WP Engine’s roughly $400 million in annual revenue, or about $32 million.
“WP Engine’s unauthorized use of our Client’s trademarks… has enabled WP Engine to unfairly compete with our Client, leading to WP Engine’s unjust enrichment,” Automattic alleged in the letter.
Mullenweg: WP Engine “a cancer to WordPress”
Mullenweg co-authored the WordPress software first released in 2003 and founded Automattic in 2005. Automattic operates the WordPress-based publishing platform WordPress.com. Meanwhile, the nonprofit WordPress Foundation, also founded by Mullenweg, says it works “to ensure free access, in perpetuity, to the software projects we support.”
Meta smart glasses can be used to dox anyone in seconds, study finds
To prevent anyone from being doxxed, the co-creators are not releasing the code, Nguyen said on social media site X. They did, however, outline how their disturbing tech works and how shocked random strangers used as test subjects were to discover how easily identifiable they are just from accessing with the smart glasses information posted publicly online.
Nguyen and Ardayfio tested out their technology at a subway station “on unsuspecting people in the real world,” 404 Media noted. To demonstrate how the tech could be abused to trick people, the students even claimed to know some of the test subjects, seemingly using information gleaned from the glasses to make resonant references and fake an acquaintance.
Dozens of test subjects were identified, the students claimed, although some results have been contested, 404 Media reported. To keep their face-scanning under the radar, the students covered up a light that automatically comes on when the Meta Ray Bans 2 are recording, Ardayfio said on X.
Opt out of PimEyes now, students warn
For Nguyen and Ardayfio, the point of the project was to persuade people to opt out of invasive search engines to protect their privacy online. An attempt to use I-XRAY to identify 404 Media reporter Joseph Cox, for example, didn’t work because he’d opted out of PimEyes.
But while privacy is clearly important to the students and their demo video strove to remove identifying information, at least one test subject was “easily” identified anyway, 404 Media reported. That test subject couldn’t be reached for comment, 404 Media reported.
So far, neither Facebook nor Google has chosen to release similar technologies that they developed linking smart glasses to face search engines, The New York Times reported.
Amazon illegally refused to bargain with drivers’ union, NLRB alleges
The National Labor Relations Board (NLRB) has filed charges against Amazon, alleging that the e-commerce giant has illegally refused to bargain with a union representing drivers who are frustrated by what they claim are low wages and dangerous working conditions.
Back in August, drivers celebrated what they considered a major win when the NLRB found that Amazon was a joint employer of sub-contracted drivers, cheering “We are Amazon workers!” At that time, Amazon seemed to be downplaying the designation, telling Ars that the union was trying to “misrepresent” a merit determination that the NLRB confirmed was only “the first step in the NLRB’s General Counsel litigating the allegations after investigating an unfair labor practice charge.”
Amazon has found itself in increasingly hot water ever since the Palmdale drivers joined the International Brotherhood of Teamsters union in 2021. The NLRB’s complaint called out Amazon for terminating its contract with the unionized drivers without ever engaging in bargaining.
The tech company could have potentially avoided the NLRB charges if Amazon had settled with drivers, who claimed that rather than negotiate, Amazon had intimidated employees with security guards and illegally retaliated against workers unionizing.
Although Amazon recently invested $2.1 billion—its “biggest investment yet”—to improve driver safety and increase drivers’ wages, Amazon apparently did not do enough to settle drivers’ complaints.
The NLRB said in a press release sent to Ars that the complaint specifically alleged that “Amazon failed and refused to bargain” with Teamsters “and that it did not afford the union the opportunity to bargain over the effects of terminating” the Palmdale drivers’ contract, “increasing inspections, reducing and termination routes, and terminating employees in the bargaining unit.” Additionally, “the complaint further alleged that Amazon made unlawful threats and promises, held captive audience meetings, delayed employee start times and increased vehicle inspections to discourage union activities, and failed and refused to furnish information to the union.”
DirecTV/Dish merger has a problem as debt holders object to $1.6 billion loss
DirecTV’s agreement to buy the Dish satellite and streaming TV business from EchoStar is facing opposition from Dish creditors who would be forced to take a loss on the value of their debt.
Dish creditors “plan to block a distressed exchange that’s a key part of its tie-up with rival DirecTV, according to people familiar with the matter,” Bloomberg reported today. “A group of steering committee investors has gained a blocking position in order to negotiate with the company, the people said. They may even explore a better outcome through litigation, said some of the people.” The Bloomberg article was titled, “Dish-DirecTV Deal Sparks Creditor Revolt Over $1.6 Billion Loss.”
As Bloomberg notes, “Dish needs consent from its bondholders to exchange old debts for notes issued out of the new combined entity” in order to complete the deal. A previous Bloomberg article said that “just over two-thirds of [Dish] bondholders in each series of notes have to agree to the exchange, with the deadline set for October 29.” EchoStar executives argue that debt holders will benefit from the merger by “owning debt of a stronger company with lower leverage,” the article said.
Credit-rating firm S&P Global said in a research note that it views “these transactions as tantamount to a default because investors will receive less value than the promise of the original securities,” according to Variety. On the other hand, S&P Global “added that in exchange the new notes will carry a higher rate of 8.875 percent and be secured by assets of the combined businesses of DirecTV and Dish,” Variety wrote.
Debt exchange
DirecTV agreed to buy the Dish satellite TV and Sling TV business for a nominal fee of $1 in exchange for taking on $9.75 billion of Dish debt. But DirecTV’s deal announcement on Monday said the merger needs approval from Dish debt holders, who would see their investments devalued.
Dish notes would be exchanged with “a reduced principal amount of DirecTV debt which will have terms and collateral that mirror DirecTV’s existing secured debt,” DirecTV said. DirecTV’s announcement goes on to say that the principal amount will be reduced by at least $1.568 billion and that the deal can be scrapped if debt holders object:
T-Mobile has agreed to pay a $15.75 million fine and improve its security in a settlement over a series of data breaches over three years that affected tens of millions of customers.
“T-Mobile suffered data breaches in 2021, 2022, and 2023,” the Federal Communications Commission Enforcement Bureau said in an order approving a consent decree yesterday. “Combined, these breaches affected millions of current, former, or prospective T-Mobile customers and millions of end-user customers of T-Mobile wireless service resellers, which operate on T-Mobile’s network infrastructure and are known as mobile virtual network operators (MVNOs).”
Four breaches occurring over three years exposed personal information, including customer names, addresses, dates of birth, Social Security numbers, driver’s license numbers, the features customers subscribed to, and the number of lines on their accounts.
Uber beats crash victims’ attempt to try case in court instead of arbitration
Getty Images | NurPhoto
A married couple can’t sue Uber over severe injuries they suffered in a 2022 car accident because of a mandatory arbitration provision in the ride-sharing company’s terms of use, according to a ruling issued by the New Jersey Superior Court appellate division.
In November 2023, a lower court denied Uber’s motion to compel arbitration and dismiss the complaint filed by plaintiffs Georgia and John McGinty. But the lower-court ruling was reversed on September 20 in a unanimous decision by three appellate court judges.
Georgia McGinty had agreed to Uber’s arbitration clause long before the accident. But the couple challenged the terms in part because they say their minor daughter, then 12, was the one who clicked the most recent terms agreement when the girl ordered food through Uber Eats. Those newer terms were also allegedly less specific about users waiving the right to a jury trial.
The September 20 ruling says:
Uber’s digital records show that on January 8, 2022, Georgia logged into her Uber account using her password, checked the box next to the statement “I have reviewed and agree to the Terms of Use,” and pressed “Confirm.” In their motion opposition, plaintiffs asserted that it was not Georgia but rather their minor daughter who checked that box and clicked the “Confirm” button—even though it required attesting to Uber that she was at least eighteen years old. Plaintiffs claim that their daughter, while using Georgia’s phone and with Georgia’s permission, confirmed her agreement to the December [2021] Terms before ordering food for plaintiffs to be delivered to them through Uber Eats.
The December Terms to which Georgia agreed—either by herself or through her daughter using her Uber account—contain an arbitration provision. That agreement provides disputes that may arise between Georgia and Uber, including disputes concerning auto accidents or personal injuries, will be resolved through binding arbitration “and not in a court of law.” The agreement also provides that any disputes over arbitrability would be delegated to the arbitrator.
“We hold that the arbitration provision contained in the agreement under review, which Georgia or her minor daughter, while using her cell phone agreed to, is valid and enforceable,” judges wrote.
Lower court said Uber terms were too vague
The case came to the appellate court on appeal from the Superior Court of New Jersey, Law Division, Middlesex County. The lower court found that Uber’s updated terms “fail[ed] to clearly and unambiguously inform plaintiff of her waiver of the right to pursue her claims in a judicial forum,” making it unclear that “arbitration is a substitute for the right to seek relief in our court system.”
While an earlier version of Uber’s terms contained an express jury waiver provision, the newer version did not. The lower court held that the newer agreement “lacks any specificity on what the resolution would look like or what the alternative to such resolution might be.”
Uber argued that even if the newer terms are invalid, the earlier terms would still require arbitration of the dispute, and that Georgia McGinty can’t escape her agreement with Uber by claiming that her daughter agreed to the newer terms on her behalf.
Despite the newer agreement not using the word “jury,” the appellate court said that legal precedent “does not require specific jury trial language to accomplish a waiver of rights.” Judges said the Uber provision requiring disputes to be handled in arbitration “and not in a court of law… clearly and unambiguously evidences a waiver of plaintiffs’ right to pursue any claims against Uber in a court of law and obligates plaintiffs to resolve their claims through binding arbitration.”
“While ‘jury’ is no longer explicitly used in the updated December Terms, magic words are not required for enforceability and the clause clearly intimates that disputes are resolved through arbitration,” the court said.
The question of whether the couple’s daughter was capable of agreeing to the terms must be decided by an arbitrator, according to the ruling:
Georgia certified that her daughter was “capable,” would frequently order food, and she and John were preoccupied with packing, which supports the inference that the daughter acted knowingly on Georgia’s behalf. In summary, the Arbitration Agreement is valid and delegates the threshold question of the scope of the arbitration to the arbitrator. Therefore, Georgia’s reliance on her daughter’s minority to raise an infancy defense shall be determined by the arbitrator.
https://arstechnica.com/?p=2053490
In fear of more user protests, Reddit announces controversial policy change
Following site-wide user protests last year that featured moderators turning thousands of subreddits private or not-safe-for-work (NSFW), Reddit announced that mods now need its permission to make those changes.
Reddit’s VP of community, going by Go_JasonWaterfalls, made the announcement about what Reddit calls Community Types today. Reddit’s permission is also required to make subreddits restricted or to go from NSFW to safe-for-work (SFW). Reddit’s employee claimed that requests will be responded to “in under 24 hours.”
Reddit’s employee said that “temporarily going restricted is exempt” from this requirement, adding that “mods can continue to instantly restrict posts and/or comments for up to 7 days using Temporary Events.” Additionally, if a subreddit has fewer than 5,000 members or is less than 30 days old, the request “will be automatically approved,” per Go_JasonWaterfalls.
Reddit’s post includes a list of “valid” reasons that mods tend to change their subreddit’s Community Type and provides alternative solutions.
Last year’s protests “accelerated” this policy change
Last year, Reddit announced that it would be charging a massive amount for access to its previously free API. This caused many popular third-party Reddit apps to close down. Reddit users then protested by turning subreddits private (or read-only) or by only showing NSFW content or jokes and memes. Reddit then responded by removing some moderators; eventually, the protests subsided.
Reddit, which previously admitted that another similar protest could hurt it financially, has maintained that moderators’ actions during the protests broke its rules. Now, it has solidified a way to prevent something like last year’s site-wide protests from happening again.
Speaking to The Verge, Laura Nestler, who The Verge reported is Go_JasonWaterfalls, claimed that Reddit has been talking about making this change since at least 2021. The protests, she said, were a wake-up call that moderators’ ability to turn subreddits private “could be used to harm Reddit at scale. The protests “accelerated” the policy change, per Nestler.
The announcement on r/modnews reads:
… the ability to instantly change Community Type settings has been used to break the platform and violate our rules. We have a responsibility to protect Reddit and ensure its long-term health, and we cannot allow actions that deliberately cause harm.
After shutting down a tactic for responding to unfavorable Reddit policy changes, Go_JasonWaterfalls claimed that Reddit still wants to hear from users.
“Community Type settings have historically been used to protest Reddit’s decisions,” they wrote.
“While we are making this change to ensure users’ expectations regarding a community’s access do not suddenly change, protest is allowed on Reddit. We want to hear from you when you think Reddit is making decisions that are not in your communities’ best interests. But if a protest crosses the line into harming redditors and Reddit, we’ll step in.”
Last year’s user protests illustrated how dependent Reddit is on unpaid moderators and user-generated content. At times, things turned ugly, pitting Reddit executives against long-time users (Reddit CEO Steve Huffman infamously called Reddit mods “landed gentry,” something that some were quick to remind Go_JasonWaterfalls of) and reportedly worrying Reddit employees.
Although the protests failed to reverse Reddit’s prohibitive API fees or to save most third-party apps, it succeeded in getting users’ concerns heard and even crashed Reddit for three hours. Further, NFSW protests temporarily prevented Reddit from selling ads on some subreddits. Since going public this year and amid a push to reach profitability, Reddit has been more focused on ads than ever. (Most of Reddit’s money comes from ads.)
Reddit’s Nestler told The Verge that the new policy was reviewed by Reddit’s Mod Council. Reddit is confident that it won’t lose mods because of the change, she said.
“Demotes us all to janitors”
The news marks another broad policy change that is likely to upset users and make Reddit seem unwilling to give into user feedback, despite Go_JasonWaterfalls saying that “protest is allowed on Reddit.” For example, in response, Reddit user CouncilOfStrongs said:
Don’t lie to us, please.
Something that you can ignore because it has no impact cannot be a protest, and no matter what you say that is obviously the one and only point of you doing this – to block moderators from being able to hold Reddit accountable in even the smallest way for malicious, irresponsible, bad faith changes that they make.
Reddit user belisaurius, who is listed as a mod for several active subreddits, including a 336,000-member one for the Philadelphia Eagles NFL team, said that the policy change “removes moderators from any position of central responsibility and demotes us all to janitors.”
As Reddit continues seeking profits and seemingly more control over a platform built around free user-generated content and moderation, users will have to either accept that Reddit is changing or leave the platform.
Advance Publications, which owns Ars Technica parent Condé Nast, is the largest shareholder in Reddit.
https://arstechnica.com/?p=2053478
Opinion: How to design a US data privacy law
Nick Dedeke is an associate teaching professor at Northeastern University, Boston. His research interests include digital transformation strategies, ethics, and privacy. His research has been published in IEEE Management Review, IEEE Spectrum, and the Journal of Business Ethics. He holds a PhD in Industrial Engineering from the University of Kaiserslautern-Landau, Germany. The opinions in this piece do not necessarily reflect the views of Ars Technica.
In an earlier article, I discussed a few of the flaws in Europe’s flagship data privacy law, the General Data Protection Regulation (GDPR). Building on that critique, I would now like to go further, proposing specifications for developing a robust privacy protection regime in the US.
Writers must overcome several hurdles to have a chance at persuading readers about possible flaws in the GDPR. First, some readers are skeptical of any piece criticizing the GDPR because they believe the law is still too young to evaluate. Second, some are suspicious of any piece criticizing the GDPR because they suspect that the authors might be covert supporters of Big Tech’s anti-GDPR agenda. (I can assure readers that I am not, nor have I ever, worked to support any agenda of Big Tech companies.)
In this piece, I will highlight the price of ignoring the GDPR. Then, I will present several conceptual flaws of the GDPR that have been acknowledged by one of the lead architects of the law. Next, I will propose certain characteristics and design requirements that countries like the United States should consider when developing a privacy protection law. Lastly, I provide a few reasons why everyone should care about this project.
The high price of ignoring the GDPR
People sometimes assume that the GDPR is mostly a “bureaucratic headache”—but this perspective is no longer valid. Consider the following actions by administrators of the GDPR in different countries.
In May 2023, the Irish authorities hit Meta with a fine of $1.3 billion for unlawfully transferring personal data from the European Union to the US.
On July 16, 2021, the Luxembourg National Commission for Data Protection (CNDP) issued a fine of 746 million euros ($888 million) to Amazon Inc. The fine was issued due to a complaint from 10,000 people against Amazon in May 2018 orchestrated by a French privacy rights group.
On September 5, 2022, Ireland’s Data Protection Commission (DPC) issued a 405 million-euro GDPR fine to Meta Ireland as a penalty for violating GDPR’s stipulation regarding the lawfulness of children’s data (see other fines here).
In other words, the GDPR is not merely a bureaucratic matter; it can trigger hefty, unexpected fines. The notion that the GDPR can be ignored is a fatal error.
9 conceptual flaws of the GDPR: Perspective of the GDPR’s lead architect
Axel Voss is one of the lead architects of the GDPR. He is a member of the European Parliament and authored the 2011 initiative report titled “Comprehensive Approach to Personal Data Protection in the EU” when he was the European Parliament’s rapporteur. His call for action resulted in the development of the GDPR legislation. After observing the unfulfilled promises of the GDPR, Voss wrote a position paper highlighting the law’s weaknesses. I want to mention nine of the flaws that Voss described.
First, while the GDPR was excellent in theory and pointed a path toward the improvement of standards for data protection, it is an overly bureaucratic law created largely using a top-down approach by EU bureaucrats.
Second, the law is based on the premise that data protection should be a fundamental right of EU persons. Hence, the stipulations are absolute and one-sided or laser-focused only on protecting the “fundamental rights and freedoms” of natural persons. In making this change, the GDPR architects have transferred the relationship between the state and the citizen and applied it to the relationship between citizens and companies and the relationship between companies and their peers. This construction is one reason why the obligations imposed on data controllers and processors are rigid.
Third, the GDPR law aims to empower the data subjects by giving them rights and enshrining these rights into law. Specifically, the law enshrines nine data subject rights into law. They are: the right to be informed, the right to access, the right to rectification, the right to be forgotten/or to erasure, the right to data portability, the right to restrict processing, the right to object to the processing of personal data, the right to object to automated processing and the right to withdraw consent. As with any list, there is always a concern that some rights may be missing. If critical rights are omitted from the GDPR, it would hinder the effectiveness of the law in protecting privacy and data protection. Specifically, in the case of the GDPR, the protected data subject rights are not exhaustive.
Fourth, the GDPR is grounded on a prohibition and limitation approach to data protection. For example, the principle of purpose limitation excludes chance discoveries in science. This ignores the reality that current technologies, e.g., machine learning and artificial Intelligence applications, function differently. Hence, these old data protection mindsets, such as data minimization and storage limitation, are not workable anymore.
Fifth, the GDPR, on principle, posits that every processing of personal data restricts the data subject’s right to data protection. It requires, therefore, that each of these processes needs a justification based on the law. The GDPR deems any processing of personal data as a potential risk and forbids its processing in principle. It only allows processing if a legal ground is met. Such an anti-processing and anti-sharing approach may not make sense in a data-driven economy.
Sixth, the law does not distinguish between low-risk and high-risk applications by imposing the same obligations for each type of data processing application, with a few exceptions requiring consultation of the Data Processing Administrator for high-risk applications.
Seventh, the GDPR also excludes exemptions for low-risk processing scenarios or when SMEs, startups, non-commercial entities, or private citizens are the data controllers. Further, there are no exemptions or provisions that protect the rights of the controller and of third parties for such scenarios in which the data controller has a legitimate interest in protecting business and trade secrets, fulfilling confidentiality obligations, or the economic interest in avoiding huge and disproportionate efforts to meet GDPR obligations.
Eighth, the GDPR lacks a mechanism that allows SMEs and startups to shift the compliance burden onto third parties, which then store and process data.
Ninth, the GPR relies heavily on government-based bureaucratic monitoring and administration of GDPR privacy compliance. This means an extensive bureaucratic system is needed to manage the compliance regime.
There are other issues with GDPR enforcement (see pieces by Matt Burgess and Anda Bologa) and its negative impacts on the EU’s digital economy and on Irish technology companies. This piece will focus only on the nine flaws described above. These nine flaws are some of the reasons why the US authorities should not simply copy the GDPR.
The good news is that many of these flaws can be resolved.
https://arstechnica.com/?p=2053275
Steam doesn’t want to pay arbitration fees, tells gamers to sue instead
Valve Corporation, tired of paying arbitration fees, has removed a mandatory arbitration clause from Steam’s subscriber agreement. Valve told gamers in yesterday’s update that they must sue the company in order to resolve disputes.
The subscriber agreement includes “changes to how disputes and claims between you and Valve are resolved,” Steam wrote in an email to users. “The updated dispute resolution provisions are in Section 10 and require all claims and disputes to proceed in court and not in arbitration. We’ve also removed the class action waiver and cost and fee-shifting provisions.”
The Steam agreement previously said that “you and Valve agree to resolve all disputes and claims between us in individual binding arbitration.” Now, it says that any claims “shall be commenced and maintained exclusively in any state or federal court located in King County, Washington, having subject matter jurisdiction.”
Steam’s email to users said the updated terms “will become effective immediately when you agree to it, including when you make most purchases, fund your Steam wallet, or otherwise accept it. Otherwise, the updated Steam Subscriber Agreement will become effective on November 1, 2024, unless you delete or discontinue use of your Steam account before then.” Steam also pushed a pop-up message to gamers asking them to agree to the new terms.
One likely factor in Valve’s decision to abandon arbitration is mentioned in a pending class-action lawsuit over game prices that was filed last month in US District Court for the Western District of Washington. The Steam users who filed the suit previously “mounted a sustained and ultimately successful challenge to the enforceability of Valve’s arbitration provision,” their lawsuit said. “Specifically, the named Plaintiffs won binding decisions from arbitrators rendering Valve’s arbitration provision unenforceable for both lack of notice and because it impermissibly seeks to bar public injunctive relief.”
Mandatory arbitration clauses are generally seen as bad for consumers, who are deprived of the ability to seek compensation through individual or class-action lawsuits. But many Steam users were able to easily get money from Valve through arbitration, according to law firms that filed the arbitration cases over allegedly inflated game prices.
Valve sued lawyers behind arbitration claims
Valve used to prefer arbitration because few consumers brought claims and the process kept the company’s legal costs low. But in October 2023, Valve sued a law firm in an attempt to stop it from submitting loads of arbitration claims on behalf of gamers.
Valve’s suit complained that “unscrupulous lawyers” at law firm Zaiger, LLC presented a plan to a potential funder “to recruit 75,000 clients and threaten Valve with arbitration on behalf of those clients, thus exposing Valve to potentially millions of dollars of arbitration fees alone: 75,000 potential arbitrations times $3,000 in fees per arbitration is two hundred and twenty-five million dollars.”
Valve said that Zaiger’s “extortive plan” was to “offer a settlement slightly less than the [arbitration] charge—$2,900 per claim or so—attempting to induce a quick resolution.”
“Zaiger targeted Valve and Steam users for its scheme precisely because the arbitration clause in the SSA [Steam Subscriber Agreement] is ‘favorable’ to Steam users in that Valve agrees to pay the fees and costs associated with arbitration,” Valve said.
Zaiger has a “Steam Claims” website that says, “Tens of thousands of Steam users have engaged Zaiger LLC to hold Steam’s owner, Valve, accountable for inflated prices of PC games.” The website said that through arbitration, “many consumers get compensation offers without doing anything beyond completing the initial form.” Another law firm called Mason LLP used a similar strategy to help gamers bring arbitration claims against Steam.
There hadn’t previously been many arbitration cases against Steam, Valve’s lawsuit against Zaiger said. “In the five years before Zaiger began threatening Valve, 2017 to 2022, there were only two instances where Valve and a Steam user could not resolve that user’s issue before proceeding to arbitration. Both of those arbitrations were resolved in Valve’s favor, and Valve paid all of the arbitrator fees and costs for both Valve and the impacted Steam user,” Valve said.
Valve’s lawsuit against Zaiger was dismissed without prejudice on August 20, 2024. The ruling in US District Court for the Western District of Washington said the case was dismissed because the court lacks jurisdiction over Zaiger.
