A judge in Ohio has issued a temporary restraining order against a security researcher who presented evidence that a recent ransomware attack on the city of Columbus scooped up reams of sensitive personal information, contradicting claims made by city officials.

The order, issued by a judge in Ohio’s Franklin County, came after the city of Columbus fell victim to a ransomware attack on July 18 that siphoned 6.5 terabytes of the city’s data. A ransomware group known as Rhysida took credit for the attack and offered to auction off the data with a starting bid of about $1.7 million in bitcoin. On August 8, after the auction failed to find a bidder, Rhysida released what it said was about 45 percent of the stolen data on the group’s dark web site, which is accessible to anyone with a TOR browser.

Dark web not readily available to public—really?

Columbus Mayor Andrew Ginther said on August 13 that a “breakthrough” in the city’s forensic investigation of the breach found that the sensitive files Rhysida obtained were either encrypted or corrupted, making them “unusable” to the thieves. Ginther went on to say the data’s lack of integrity was likely the reason the ransomware group had been unable to auction off the data.

Shortly after Ginther made his remarks, security researcher David Leroy Ross contacted local news outlets and presented evidence that showed the data Rhysida published was fully intact and contained highly sensitive information regarding city employees and residents. Ross, who uses the alias Connor Goodwolf, presented screenshots and other data that showed the files Rhysida had posted included names from domestic violence cases and Social Security numbers for police officers and crime victims. Some of the data spanned years.

On Thursday, the city of Columbus sued Ross for alleged damages for criminal acts, invasion of privacy, negligence, and civil conversion. The lawsuit claimed that downloading documents from a dark web site run by ransomware attackers amounted to him “interacting” with them and required special expertise and tools. The suit went on to challenge Ross alerting reporters to the information, which ii claimed would not be easily obtained by others.

“Only individuals willing to navigate and interact with the criminal element on the dark web, who also have the computer expertise and tools necessary to download data from the dark web, would be able to do so,” city attorneys wrote. “The dark web-posted data is not readily available for public consumption. Defendant is making it so.”

The same day, a Franklin County judge granted the city’s motion for a temporary restraining order against Ross. It bars the researcher “from accessing, and/or downloading, and/or disseminating” any city files that were posted to the dark web. The motion was made and granted “ex parte,” meaning in secret before Ross was informed of it or had an opportunity to present his case.

In a press conference Thursday, Columbus City Attorney Zach Klein defended his decision to sue Ross and obtain the restraining order.

“This is not about freedom of speech or whistleblowing,” he said. “This is about the downloading and disclosure of stolen criminal investigatory records. This effect is to get [Ross] to stop downloading and disclosing stolen criminal records to protect public safety.”

The Columbus city attorney’s office didn’t respond to questions sent by email. It did provide the following statement:

The lawsuit filed by the City of Columbus pertains to stolen data that Mr. Ross downloaded from the dark web to his own, local device and disseminated to the media. In fact, several outlets used the stolen data provided by Ross to go door-to-door and contact individuals using names and addresses contained within the stolen data. As has now been extensively reported, Mr. Ross also showed multiple news outlets stolen, confidential data belonging to the City which he claims reveal the identities of undercover police officers and crime victims as well as evidence from active criminal investigations. Sharing this stolen data threatens public safety and the integrity of the investigations. The temporary restraining order granted by the Court prohibits Mr. Ross from disseminating any of the City’s stolen data. Mr. Ross is still free to speak about the cyber incident and even describe what kind of data is on the dark web—he just cannot disseminate that data.

Attempts to reach Ross for comment were unsuccessful. Email sent to the Columbus mayor’s office went unanswered.

As shown above in the screenshot of the Rhysida dark web site on Friday morning, the sensitive data remains available to anyone who looks for it. Friday’s order may bar Ross from accessing the data or disseminating it to reporters, but it has no effect on those who plan to use the data for malicious purposes.

https://arstechnica.com/?p=2046614

Major technology companies, including Google, Apple, and Discord, have been enabling people to quickly sign up to harmful “undress” websites, which use AI to remove clothes from real photos to make victims appear to be “nude” without their consent. More than a dozen of these deepfake websites have been using login buttons from the tech companies for months.

A WIRED analysis found 16 of the biggest so-called undress and “nudify” websites using the sign-in infrastructure from Google, Apple, Discord, Twitter, Patreon, and Line. This approach allows people to easily create accounts on the deepfake websites—offering them a veneer of credibility—before they pay for credits and generate images.

While bots and websites that create nonconsensual intimate images of women and girls have existed for years, the number has increased with the introduction of generative AI. This kind of “undress” abuse is alarmingly widespread, with teenage boys allegedly creating images of their classmates. Tech companies have been slow to deal with the scale of the issues, critics say, with the websites appearing highly in search results, paid advertisements promoting them on social media, and apps showing up in app stores.

“This is a continuation of a trend that normalizes sexual violence against women and girls by Big Tech,” says Adam Dodge, a lawyer and founder of EndTAB (Ending Technology-Enabled Abuse). “Sign-in APIs are tools of convenience. We should never be making sexual violence an act of convenience,” he says. “We should be putting up walls around the access to these apps, and instead we’re giving people a drawbridge.”

The sign-in tools analyzed by WIRED, which are deployed through APIs and common authentication methods, allow people to use existing accounts to join the deepfake websites. Google’s login system appeared on 16 websites, Discord’s appeared on 13, and Apple’s on six. X’s button was on three websites, with Patreon and messaging service Line’s both appearing on the same two websites.

WIRED is not naming the websites, since they enable abuse. Several are part of wider networks and owned by the same individuals or companies. The login systems have been used despite the tech companies broadly having rules that state developers cannot use their services in ways that would enable harm, harassment, or invade people’s privacy.

After being contacted by WIRED, spokespeople for Discord and Apple said they have removed the developer accounts connected to their websites. Google said it will take action against developers when it finds its terms have been violated. Patreon said it prohibits accounts that allow explicit imagery to be created, and Line confirmed it is investigating but said it could not comment on specific websites. X did not reply to a request for comment about the way its systems are being used.

In the hours after Jud Hoffman, Discord vice president of trust and safety, told WIRED it had terminated the websites’ access to its APIs for violating its developer policy, one of the undress websites posted in a Telegram channel that authorization via Discord was “temporarily unavailable” and claimed it was trying to restore access. That undress service did not respond to WIRED’s request for comment about its operations.

https://arstechnica.com/?p=2046575

After Stanford Internet Observatory researcher David Thiel found links to child sexual abuse materials (CSAM) in an AI training dataset tainting image generators, the controversial dataset was immediately taken down in 2023.

Now, the LAION (Large-scale Artificial Intelligence Open Network) team has released a scrubbed version of the LAION-5B dataset called Re-LAION-5B and claimed that it “is the first web-scale, text-link to images pair dataset to be thoroughly cleaned of known links to suspected CSAM.”

To scrub the dataset, LAION partnered with the Internet Watch Foundation (IWF) and the Canadian Center for Child Protection (C3P) to remove 2,236 links that matched with hashed images in the online safety organizations’ databases. Removals include all the links flagged by Thiel, as well as content flagged by LAION’s partners and other watchdogs, like Human Rights Watch, which warned of privacy issues after finding photos of real kids included in the dataset without their consent.

In his study, Thiel warned that “the inclusion of child abuse material in AI model training data teaches tools to associate children in illicit sexual activity and uses known child abuse images to generate new, potentially realistic child abuse content.”

Thiel urged LAION and other researchers scraping the Internet for AI training data that a new safety standard was needed to better filter out not just CSAM, but any explicit imagery that could be combined with photos of children to generate CSAM. (Recently, the US Department of Justice pointedly said that “CSAM generated by AI is still CSAM.”)

While LAION’s new dataset won’t alter models that were trained on the prior dataset, LAION claimed that Re-LAION-5B sets “a new safety standard for cleaning web-scale image-link datasets.” Where before illegal content “slipped through” LAION’s filters, the researchers have now developed an improved new system “for identifying and removing illegal content,” LAION’s blog said.

Thiel told Ars that he would agree that LAION has set a new safety standard with its latest release, but “there are absolutely ways to improve it.” However, “those methods would require possession of all original images or a brand new crawl,” and LAION’s post made clear that it only utilized image hashes and did not conduct a new crawl that could have risked pulling in more illegal or sensitive content. (On Threads, Thiel shared more in-depth impressions of LAION’s effort to clean the dataset.)

LAION warned that “current state-of-the-art filters alone are not reliable enough to guarantee protection from CSAM in web scale data composition scenarios.”

“To ensure better filtering, lists of hashes of suspected links or images created by expert organizations (in our case, IWF and C3P) are suitable choices,” LAION’s blog said. “We recommend research labs and any other organizations composing datasets from the public web to partner with organizations like IWF and C3P to obtain such hash lists and use those for filtering. In the longer term, a larger common initiative can be created that makes such hash lists available for the research community working on dataset composition from web.”

According to LAION, the bigger concern is that some links to known CSAM scraped into a 2022 dataset are still active more than a year later.

“It is a clear hint that law enforcement bodies have to intensify the efforts to take down domains that host such image content on public web following information and recommendations by organizations like IWF and C3P, making it a safer place, also for various kinds of research related activities,” LAION’s blog said.

HRW researcher Hye Jung Han praised LAION for removing sensitive data that she flagged, while also urging more interventions.

“LAION’s responsive removal of some children’s personal photos from their dataset is very welcome, and will help to protect these children from their likenesses being misused by AI systems,” Han told Ars. “It’s now up to governments to pass child data protection laws that would protect all children’s privacy online.”

Although LAION’s blog said that the content removals represented an “upper bound” of CSAM that existed in the initial dataset, AI specialist and Creative.AI co-founder Alex Champandard told Ars that he’s skeptical that all CSAM was removed.

“They only filter out previously identified CSAM, which is only a partial solution,” Champandard told Ars. “Statistically speaking, most instances of CSAM have likely never been reported nor investigated by C3P or IWF. A more reasonable estimate of the problem is about 25,000 instances of things you’d never want to train generative models on—maybe even 50,000.”

Champandard agreed with Han that more regulations are needed to protect people from AI harms when training data is scraped from the web.

“There’s room for improvement on all fronts: privacy, copyright, illegal content, etc.,” Champandard said. Because “there are too many data rights being broken with such web-scraped datasets,” Champandard suggested that datasets like LAION’s won’t “stand the test of time.”

“LAION is simply operating in the regulatory gap and lag in the judiciary system until policymakers realize the magnitude of the problem,” Champandard said.

https://arstechnica.com/?p=2046573

A federal judge in Texas yesterday ruled that Elon Musk’s X Corp. can continue its lawsuit against Media Matters for America. US District Judge Reed O’Connor of the Northern District of Texas, who recently refused to recuse himself from the case despite having purchased Tesla stock, denied Media Matters’ motion to dismiss.

X Corp. sued Media Matters after the nonprofit watchdog group published research on ads being placed next to pro-Nazi content on X, formerly Twitter. X’s lawsuit also names reporter Eric Hananoki and Media Matters President Angelo Carusone as defendants.

Because of O’Connor’s ruling, X can move ahead with its claims of tortious interference with contract, business disparagement, and tortious interference with prospective economic advantage. A jury trial is scheduled to begin on April 7, 2025.

“Plaintiff alleges that Defendants knowingly and maliciously fabricated side-by-side images of various advertisers’ posts on Plaintiff’s social media platform X depicted next to neo-Nazi or other extremist content, and portrayed these designed images as if they were what the average user experiences on the X platform,” O’Connor wrote in his ruling on the motion to dismiss. “Plaintiff asserts that Defendants proceeded with this course of action in an effort to publicly portray X as a social media platform dominated by neo-Nazism and anti-Semitism, and thereby alienate major advertisers, publishers, and users away from the X platform, intending to harm it.”

A different federal judge in the District of Columbia recently criticized X’s claims, pointing out that “X did not deny that advertising in fact had appeared next to the extremist posts on the day in question.” But X has a more friendly judge in O’Connor, who has made several rulings against Media Matters. The defendant could also face a tough road on appeal because challenges would go to the conservative-leaning US Court of Appeals for the 5th Circuit.

Judge: Media Matters “targeted” Texas-based advertisers

Media Matters’ motion to dismiss argues in part that Texas is an improper forum for the dispute because “X is organized under Nevada law and maintains its principal place of business in San Francisco, California, where its own terms of service require users of its platform to litigate any disputes.” (Musk recently said that X will move its headquarters from San Francisco to Austin, Texas.)

O’Connor’s ruling acknowledges that “when a nonresident defendant files a motion to dismiss for lack of personal jurisdiction, the burden of proof is on the plaintiff as the party seeking to invoke the district court’s jurisdiction.” In this case, O’Connor said that jurisdiction is established if the defendants “targeted the conduct that is the basis for this lawsuit at Texas.”

O’Connor ruled that the court has jurisdiction because Media Matters articles “targeted” Texas-based companies that advertised on X, specifically Oracle and AT&T, even though those companies are not parties to the lawsuit. O’Connor said the Media Matters “articles targeted, among others, Oracle, a Texas-based company that placed ads on Plaintiff’s platform… Plaintiff also alleges that this ‘crusade’ targeted its blue-chip advertisers which included Oracle and AT&T, Texas-based companies.”

O’Connor, a George W. Bush appointee, wrote that a “defendant who targets a Texas company with tortious activity has fair warning that it may be sued there.”

“This targeting of the alleged tortious acts at the headquarters of Texas-based companies is sufficient to establish specific jurisdiction in Texas… each Defendant engaged in the alleged tortious acts which targeted harm in, among other places, Texas,” he wrote.

Judge cites TV appearances

That includes Hananoki, the Media Matters reporter who wrote the articles, and Carusone. Each of those individual defendants “targeted” the conduct at Texas, O’Connor found.

“Plaintiff alleges Carusone participated in the ‘crusade’ with Hananoki and Media Matters when he appeared on television shows a number of times discussing the importance of advertisers to Plaintiff’s business model and advocating that advertisers should cease doing business with Plaintiff if there is a deluge of ‘unmoderated right-wing hatred and misinformation,'” O’Connor wrote.

Ruling that “Media Matters targeted Texas,” O’Connor wrote that the group pursued “a strategy to target Plaintiff’s blue-chip advertisers, including Oracle and AT&T, Texas-based companies; in furtherance of this strategy it published the Hananoki articles, and it published other articles pressuring the blue-chip advertisers, all to pressure blue-chip advertisers to cease doing business with Plaintiff. Finally, the inference from Media Matters’ affidavit is that Media Matters also emailed the Hananoki articles to Texans, and Plaintiff’s lawsuit arises out of this conduct.”

Media Matters also sought dismissal on the basis that X failed to state a claim. But O’Connor said that “the Court must accept all well-pleaded facts in the complaint as true and view them in the light most favorable to the plaintiff,” and he found that X “has provided sufficient allegations to survive dismissal.”

Media Matters declined to comment when contacted by Ars today.

https://arstechnica.com/?p=2046511

The rise in child sexual abuse material (CSAM) has been one of the darkest Internet trends, but after years of covering CSAM cases, I’ve found that few of those arrested show deep technical sophistication. (Perhaps this is simply because the technically sophisticated are better at avoiding arrest.)

Most understand that what they are doing is illegal and that password protection is required, both for their devices and online communities. Some can also use tools like TOR (The Onion Router). And, increasingly, encrypted (or at least encrypted-capable) chat apps might be in play.

But I’ve never seen anyone who, when arrested, had three Samsung Galaxy phones filled with “tens of thousands of videos and images” depicting CSAM, all of it hidden behind a secrecy-focused, password-protected app called “Calculator Photo Vault.” Nor have I seen anyone arrested for CSAM having used all of the following:

• Potato Chat (“Use the most advanced encryption technology to ensure information security.”)
• Enigma (“The server only stores the encrypted message, and only the users client can decrypt it.”)
• nandbox [presumably the Messenger app] (“Free Secured Calls & Messages,”)
• Telegram (“To this day, we have disclosed 0 bytes of user data to third parties, including governments.”)
• TOR (“Browse Privately. Explore Freely.”)
• Mega NZ (“We use zero-knowledge encryption.”)
• Web-based generative AI tools/chatbots

That’s what made this week’s indictment in Alaska of a heavy vehicle driver for the US military so unusual.

According to the government, Seth Herrera not only used all of these tools to store and download CSAM, but he also created his own—and in two disturbing varieties. First, he allegedly recorded nude minor children himself and later “zoomed in on and enhanced those images using AI-powered technology.”

Secondly, he took this imagery he had created and then “turned to AI chatbots to ensure these minor victims would be depicted as if they had engaged in the type of sexual contact he wanted to see.” In other words, he created fake AI CSAM—but using imagery of real kids.

The material was allegedly stored behind password protection on his phone(s) but also on Mega and on Telegram, where Herrera is said to have “created his own public Telegram group to store his CSAM.” He also joined “multiple CSAM-related Enigma groups” and frequented dark websites with taglines like “The Only Child Porn Site you need!”

Despite all the precautions, Herrera’s home was searched and his phones were seized by Homeland Security Investigations; he was eventually arrested on August 23. In a court filing that day, a government attorney noted that Herrera “was arrested this morning with another smartphone—the same make and model as one of his previously seized devices.”

Caught anyway

The government is cagey about how, exactly, this criminal activity was unearthed, noting only that Herrera “tried to access a link containing apparent CSAM.” Presumably, this “apparent” CSAM was a government honeypot file or web-based redirect that logged the IP address and any other relevant information of anyone who clicked on it.

In the end, given that fatal click, none of the “I’ll hide it behind an encrypted app that looks like a calculator!” technical sophistication accomplished much. Forensic reviews of Herrera’s three phones now form the primary basis for the charges against him, and Herrera himself allegedly “admitted to seeing CSAM online for the past year and a half” in an interview with the feds.

Since Herrera himself has a young daughter, and since there are “six children living within his fourplex alone” on Joint Base Elmendorf-Richardson, the government has asked a judge not to release Herrera on bail before his trial.

https://arstechnica.com/?p=2046303

Telegram CEO Pavel Durov was indicted in France today and ordered to post bail of 5 million euros. The multi-billionaire was forbidden from leaving the country and must report to police twice a week while the case continues.

Charges were detailed in a statement issued today by Paris prosecutor Laure Beccuau, which was provided to Ars. They are nearly identical to the possible charges released by Beccuau on Monday.

The first charge listed is complicity in “web-mastering an online platform in order to enable an illegal transaction in organized group.” Today’s press release said this charge carries a maximum penalty of 10 years in prison and a 500,000-euro fine.

Telegram’s alleged refusal to cooperate with law enforcement on criminal investigations resulted in a charge of “refusal to communicate, at the request of competent authorities, information or documents necessary for carrying out and operating interceptions allowed by law.”

Beccuau said there was a near-total lack of response from Telegram to requests for cooperation in cases related to crimes against minors, drug crimes, and online hate. This led authorities “to open an investigation into the possible criminal responsibility of the messaging app’s executives in the commission of these offenses,” Beccuau said, as quoted by Bloomberg.

Durov was further charged with complicity in drug trafficking and distribution of child pornography.

Cryptology-related charges

He was also charged with providing cryptology services without making required declarations to government officials. Under French law, providers of cryptology must make declarations to ANSSI, the country’s cybersecurity agency. French authorities may request that companies provide “the technical characteristics and the source code of the means of cryptology which was the subject of the declaration.”

The charges against Durov include “providing cryptology services aiming to ensure confidentiality without certified declaration,” “providing a cryptology tool not solely ensuring authentication or integrity monitoring without prior declaration,” and “importing a cryptology tool ensuring authentication or integrity monitoring without prior declaration.”

Telegram offers a mix of private messaging and social network features. Telegram messages do not have end-to-end encryption by default, but the security feature can be enabled for one-on-one conversations.

In response to Durov’s arrest, Telegram said on Sunday that it follows the law and industry standards on moderation and called it “absurd to claim that a platform or its owner are responsible for abuse of that platform.”

French authorities also reportedly issued a warrant for the arrest of Durov’s brother and fellow Telegram co-founder, Nikolai.

https://arstechnica.com/?p=2046072

An appeals court has revived a lawsuit against TikTok by reversing a lower court’s ruling that Section 230 immunity shielded the short video app from liability after a child died taking part in a dangerous “Blackout Challenge.”

Several kids died taking part in the “Blackout Challenge,” which Third Circuit Judge Patty Shwartz described in her opinion as encouraging users “to choke themselves with belts, purse strings, or anything similar until passing out.”

Because TikTok promoted the challenge in children’s feeds, Tawainna Anderson counted among mourning parents who attempted to sue TikTok in 2022. Ultimately, she was told that TikTok was not responsible for recommending the video that caused the death of her daughter Nylah.

In her opinion, Shwartz wrote that Section 230 does not bar Anderson from arguing that TikTok’s algorithm amalgamates third-party videos, “which results in ‘an expressive product’ that ‘communicates to users’ [that a] curated stream of videos will be interesting to them.”

The judge cited a recent Supreme Court ruling that “held that a platform’s algorithm that reflects ‘editorial judgments’ about compiling the third-party speech it wants in the way it wants’ is the platform’s own ‘expressive product’ and is therefore protected by the First Amendment,” Shwartz wrote.

Because TikTok’s For You Page (FYP) algorithm decides which third-party speech to include or exclude and organizes content, TikTok’s algorithm counts as TikTok’s own “expressive activity.” That “expressive activity” is not protected by Section 230, which only shields platforms from liability for third-party speech, not platforms’ own speech, Shwartz wrote.

The appeals court has now remanded the case to the district court to rule on Anderson’s remaining claims.

Section 230 doesn’t permit “indifference” to child death

According to Shwartz, if Nylah had discovered the “Blackout Challenge” video by searching on TikTok, the platform would not be liable, but because she found it on her FYP, TikTok transformed into “an affirmative promoter of such content.”

Now TikTok will have to face Anderson’s claims that are “premised upon TikTok’s algorithm,” Shwartz said, as well as potentially other claims that Anderson may reraise that may be barred by Section 230. The District Court will have to determine which claims are barred by Section 230 “consistent” with the Third Circuit’s ruling, though.

Concurring in part, circuit Judge Paul Matey noted that by the time Nylah took part in the “Blackout Challenge,” TikTok knew about the dangers and “took no and/or completely inadequate action to extinguish and prevent the spread of the Blackout Challenge and specifically to prevent the Blackout Challenge from being shown to children on their” FYPs.

Matey wrote that Section 230 does not shield corporations “from virtually any claim loosely related to content posted by a third party,” as TikTok seems to believe. He encouraged a “far narrower” interpretation of Section 230 to stop companies like TikTok from reading the Communications Decency Act as permitting “casual indifference to the death of a 10-year-old girl.”

“Anderson’s estate may seek relief for TikTok’s knowing distribution and targeted recommendation of videos it knew could be harmful,” Matey wrote. That includes pursuing “claims seeking to hold TikTok liable for continuing to host the Blackout Challenge videos knowing they were causing the death of children” and “claims seeking to hold TikTok liable for its targeted recommendations of videos it knew were harmful.”

“The company may decide to curate the content it serves up to children to emphasize the lowest virtues, the basest tastes,” Matey wrote. “But it cannot claim immunity that Congress did not provide.”

Anderson’s lawyers at Jeffrey Goodman, Saltz Mongeluzzi & Bendesky PC previously provided Ars with a statement after the prior court’s ruling, indicating that parents weren’t prepared to stop fighting in 2022.

“The federal Communications Decency Act was never intended to allow social media companies to send dangerous content to children, and the Andersons will continue advocating for the protection of our children from an industry that exploits youth in the name of profits,” lawyers said.

TikTok did not immediately respond to Ars’ request to comment but previously vowed to “remain vigilant in our commitment to user safety” and “immediately remove” Blackout Challenge content “if found.”

https://arstechnica.com/?p=2045993

Elon Musk’s X platform made a change to its AI assistant, Grok, that may prevent it from giving users false information on election ballot deadlines and other election-related matters. From now on, X says that Grok will direct users to Vote.gov when asked election-related questions.

X, formerly Twitter, made the change about two weeks after five secretaries of state complained to the company. “On August 21, 2024, X’s Head of US and Canada Global Government Affairs informed the Office of the Minnesota Secretary of State [Steve Simon] that the platform has made changes to its AI search assistant, Grok, after a request from several Secretaries of State,” Simon’s office said in a press release yesterday.

Grok is developed by xAI, one of Musk’s other companies, and is available on X to paying subscribers.

Simon and the secretaries of state from Michigan, New Mexico, Pennsylvania, and Washington sent a letter to Musk about Grok on August 5. The letter pointed out that “within hours of President Joe Biden stepping away from his presidential candidacy on July 21, 2024, false information on ballot deadlines produced by Grok was shared on multiple social media platforms.”

The false Grok post said that the “ballot deadline has passed for several states for the 2024 election,” and listed nine states in which the deadline had supposedly expired. “This is false. In all nine states the opposite is true: The ballots are not closed, and upcoming ballot deadlines would allow for changes to candidates listed on the ballot for the offices of President and Vice President of the United States,” the August 5 letter said.

X took its time correcting false post

Grok, which has also been known to make up false news based on X users’ jokes, continued making the false ballot-deadline statement until July 31. Grok “provided inaccurate information on elections rules… and then delayed correcting its own mistake for ten days, even after it learned that the information it had spread was false,” Simon’s office said.

While that particular piece of false information was eventually corrected, the secretaries of state told Musk that X should “immediately adopt a policy of directing Grok users to CanIVote.org when asked about elections in the US.”

CanIVote.org redirects to a page maintained by the National Association of Secretaries of State. X will instead direct users to Vote.gov, which is maintained by the US government.

The secretaries of state said they are satisfied with the change given that Vote.gov and CanIvote.org are both trustworthy resources. “We appreciate X’s action to improve their platform and hope they continue to make improvements that will ensure their users have access to accurate information from trusted sources in this critical election year,” the state officials said in a joint statement.

OpenAI’s ChatGPT was already programmed to direct users to CanIVote.org, their recent letter said. “As you know, inaccuracies are to be expected for any AI products, especially chatbots based on large language models… As tens of millions of voters in the US seek basic information about voting in this major election year, X has the responsibility to ensure all voters using your platform have access to guidance that reflects true and accurate information about their constitutional right to vote,” the state officials wrote to Musk.

https://arstechnica.com/?p=2045662

A federal judge ordered Missouri’s attorney general to halt an investigation into Media Matters for America, a nonprofit journalism organization that earned Elon Musk’s wrath when it published an article showing that Musk’s X platform placed advertisements next to pro-Nazi posts.

In March, Missouri AG Andrew Bailey issued an investigative demand seeking names and addresses of all Media Matters donors who live in Missouri and a range of internal communications and documents regarding the group’s research on Musk and X. Bailey also filed a lawsuit asking Cole County Circuit Court for an order to enforce the investigative demand.

Media Matters countered by suing Bailey in US District Court for the District of Columbia. Last week, US District Judge Amit Mehta granted a preliminary injunction that prohibits Bailey from enforcing the civil investigative demand and from pursuing the related lawsuit.

Mehta had issued a similar order against Texas Attorney General Ken Paxton a few months earlier. Mehta filed a memorandum opinion on August 23 describing the reasons for granting Media Matters’ request for an injunction against Bailey.

Media Matters demonstrated a likelihood of success in its claim that Bailey took retaliatory actions designed to deter speech, Mehta wrote:

The court already has held that Defendant Paxton’s announcement of an investigation and issuance of a CID [Civil Investigative Demand] demanding records relating to Media Matters’ organization, funding, and journalism would sufficiently deter a news organization or journalist “of ordinary firmness” from speaking again about X-related matters. Defendant Bailey has gone one step further. He has filed suit not only to enforce the Missouri CID, but he has asked a state court to sanction Media Matters with a civil penalty. Such action chills speech.

X did not deny basic premise of article

Media Matters has also “likely shown that their reporting was not defamatory and therefore was protected speech,” Mehta wrote. In its public response to the November 2023 Media Matters article, “X did not deny that advertising in fact had appeared next to the extremist posts on the day in question,” Mehta wrote. He continued:

X stated that it had served “less than 50 total ad impressions” next to the “organic content featured in the Media Matters article” (a mere fraction of the 5.5 billion ad impressions served that day), and it conceded that [Media Matters reporter Eric] Hananoki and one other person had seen advertisements of two of the brands identified in the article next to the extremist content. X called these “contrived experiences,” but did not deny the basic premise of the article: that X’s platform was delivering ads of major brands next to extremist content. Many other media outlets, as recently as April 2024, have published similar findings. These other stories corroborate Hananoki’s reporting and Plaintiffs’ belief in its accuracy.

Mehta’s ruling said that Bailey made it clear that “the true purpose of his investigation” was political. “Revealingly, Defendant Bailey expressly tied the investigation to the upcoming election” during an online interview with Donald Trump Jr., Mehta wrote.

“This is absolutely a new front in the fight for the war for free speech. This investigation is really critical and again especially as we move into an election cycle in 2024,” Bailey said during the interview.

Bailey’s lawsuit in Cole County Circuit Court claimed that “Media Matters has used fraud to solicit donations from Missourians in order to trick advertisers into removing their advertisements from X, formerly Twitter, one of the last platforms dedicated to free speech in America.” Bailey hasn’t provided good evidence for this claim, Mehta wrote.

Missouri Assistant Attorney General Steven Reed “never identifies what suspected fraudulent statements or omissions Media Matters made to Missourians for the purpose of soliciting donations,” Mehta wrote. “If he means to say that Media Matters’ defamatory reporting itself is the fraud, he nowhere links that content to Media Matters’ fundraising efforts. He does not claim, for example, that Media Matters used its reporting on X to solicit donations. In fact, the webpage on which the November 16 Article appeared made no express fundraising appeal. Nor did it include a donation link. Defamation is not fraud. It is thus likely that the false reporting-as-fraudulent fundraising justification for the investigation is pretext for retaliation.”

Bailey can appeal Mehta’s order. If the order stands, the preliminary injunction would stay in force until a final judgment in Media Matters’ case against Bailey.

https://arstechnica.com/?p=2045340

After the arrest of Telegram CEO and co-founder Pavel Durov in France over the weekend, his detention was extended for up to four days while a judge decides whether he should face criminal charges.

“The detention of Durov, 39, was extended beyond Sunday night by the investigating magistrate who is handling the case, according to a source close to the investigation,” Le Monde reported. “This initial period of detention for questioning can last up to a maximum of 96 hours. When this phase of detention ends, the judge can then decide to free him or press charges and remand in further custody.”

Telegram “is accused of failure to cooperate with law enforcement over drug trafficking, child sexual content and fraud,” the BBC wrote. Telegram yesterday said it “abides by EU laws, including the Digital Services Act,” and that the platform’s “moderation is within industry standards and constantly improving.”

“Telegram’s CEO Pavel Durov has nothing to hide and travels frequently in Europe,” the company said. “It is absurd to claim that a platform or its owner are responsible for abuse of that platform. Almost a billion users globally use Telegram as means of communication and as a source of vital information. We’re awaiting a prompt resolution of this situation.”

Durov’s arrest warrant was issued by “France’s OFMIN, an office tasked with preventing violence against minors,” Le Monde wrote. The warrant is reportedly related to “a preliminary investigation into alleged offenses including fraud, drug trafficking, cyberbullying, organized crime, and promotion of terrorism.”

Reuters wrote that a police spokesman told the news agency “that Durov is under investigation by the national cyber crime and fraud offices for failing to cooperate over cyber and financial crimes on Telegram.” The New York Times reported that “Laure Beccuau, the Paris prosecutor, said in a statement that the arrest was part of an investigation opened on July 8 ‘against person unnamed’ on a raft of potential charges, including complicity in the distribution of child pornography and selling of drugs, money laundering, and a refusal to cooperate with law enforcement.”

The statement from Beccuau was released by French authorities in both French and English. It says Durov was questioned as part of an investigation into this “person unnamed.” The accusations against the unnamed person also include “web-mastering an online platform in order to enable an illegal transaction in organized group,” and “refusal to communicate, at the request of competent authorities, information or documents necessary for carrying out and operating interceptions allowed by law.”

Three of the charges being investigated are related to encryption, the French press release said. These include “providing cryptology services aiming to ensure confidentiality without certified declaration,” “providing a cryptology tool not solely ensuring authentication or integrity monitoring without prior declaration,” and “importing a cryptology tool ensuring authentication or integrity monitoring without prior declaration.”

Macron: Arrest not a political decision

Durov was born in Russia and also has citizenship in the United Arab Emirates and France. Telegram is based in the UAE.

The Russian embassy in France reportedly said it “immediately asked French authorities to explain the reasons for this detention and demanded that [Durov’s] rights be protected and that consular access be granted. Up to now, the French side is refusing to cooperate on this question.”

French President Emmanuel Macron wrote today that the French judicial system is acting independently. “The arrest of the Telegram president on French territory took place as part of an ongoing judicial investigation,” he wrote, according to a Google translation. “This is in no way a political decision. It is up to the judges to decide.” Macron also wrote that France is committed to “freedom of expression and communication.”

Telegram offers a mix of private messaging and social network features. It lets users create groups of up to 200,000 people, and its Channels feature allows the posting of public messages to audiences of any size. Telegram messages do not have end-to-end encryption by default, but the extra level of security can be enabled for one-on-one conversations.

“If you want to use end-to-end encryption in Telegram, you must manually activate an optional end-to-end encryption feature called ‘Secret Chats‘ for every single private conversation you want to have,” Matthew Green, a Johns Hopkins University professor and cryptographer, wrote. “The feature is explicitly not turned on for the vast majority of conversations, and is only available for one-on-one conversations, and never for group chats with more than two people in them.”

https://arstechnica.com/?p=2045243