The Biden administration will ban all sales of Kaspersky antivirus software in the US starting in July, according to reporting from Reuters and a filing from the US Department of Commerce (PDF).

The US believes that security software made by Moscow-based Kaspersky Lab represents a national security risk, and that the Russian government could use Kaspersky’s software to install malware, block other security updates, and “collect and weaponize the personal information of Americans,” said US Commerce Secretary Gina Raimondo.

“When you think about national security, you may think about guns and tanks and missiles,” said Raimondo during a press briefing, as reported by Wired. “But the truth is, increasingly, it’s about technology, and it’s about dual-use technology, and it’s about data.”

US businesses and consumers will be blocked from buying new software from Kaspersky starting on or around July 24, 2024, 30 days after the restrictions are scheduled to be published in the federal register. Current users will still be able to download the software, resell it, and download new updates for 100 days, which Reuters says will give affected users and businesses time to find replacement software. Rebranded products that use Kaspersky’s software will also be affected.

Companies that continue to sell Kaspersky’s software in the US after the ban goes into effect could be subject to fines.

The ban follows a two-year national security probe of Kaspersky’s antivirus software by the Department of Commerce. It’s being implemented using authority that the government says it was given under a national defense authorization act signed during the Trump administration in 2018.

The ban is the culmination of long-running concern across multiple presidential administrations. Kaspersky’s software was banned from systems at US government agencies following allegations of the company’s links to Russian intelligence operations. A month after Russia began its invasion of Ukraine in early 2022, the US Federal Communications Commission went one step further, adding Kaspersky to a security threat list that included Chinese hardware makers Huawei and ZTE. Adding Kaspersky to that list didn’t ban consumer sales, but it did prevent Kaspersky from receiving funding from the FCC.

For its part, Kaspersky and its representatives have always denied the US government’s allegations. CEO Eugene Kaspersky called the 2017 reports “BS brewed on [a] political agenda,” and the company similarly accused the FCC in 2022 of making decisions “on political grounds” and “not based on any technical assessment of Kaspersky products.”

https://arstechnica.com/?p=2032766

Pornhub will soon be blocked in five more states as the adult site continues to fight what it considers privacy-infringing age-verification laws that require Internet users to provide an ID to access pornography.

On July 1, according to a blog post on the adult site announcing the impending block, Pornhub visitors in Indiana, Idaho, Kansas, Kentucky, and Nebraska will be “greeted by a video featuring” adult entertainer Cherie Deville, “who explains why we had to make the difficult decision to block them from accessing Pornhub.”

Pornhub explained that—similar to blocks in Texas, Utah, Arkansas, Virginia, Montana, North Carolina, and Mississippi—the site refuses to comply with soon-to-be-enforceable age-verification laws in this new batch of states that allegedly put users at “substantial risk” of identity theft, phishing, and other harms.

Age-verification laws requiring adult site visitors to submit “private information many times to adult sites all over the Internet” normalizes the unnecessary disclosure of personally identifiable information (PII), Pornhub argued, warning, “this is not a privacy-by-design approach.”

Pornhub does not outright oppose age verification but advocates for laws that require device-based age verification, which allows users to access adult sites after authenticating their identity on their devices. That’s “the best and most effective solution for protecting minors and adults alike,” Pornhub argued, because the age-verification technology is proven and less PII would be shared.

“Users would only get verified once, through their operating system, not on each age-restricted site,” Pornhub’s blog said, claiming that “this dramatically reduces privacy risks and creates a very simple process for regulators to enforce.”

A spokesperson for Pornhub-owner Aylo told Ars that “unfortunately, the way many jurisdictions worldwide have chosen to implement age verification is ineffective, haphazard, and dangerous.”

“Any regulations that require hundreds of thousands of adult sites to collect significant amounts of highly sensitive personal information is putting user safety in jeopardy,” Aylo’s spokesperson told Ars. “Moreover, as experience has demonstrated, unless properly enforced, users will simply access non-compliant sites or find other methods of evading these laws.

Age-verification laws are harmful, Pornhub says

Pornhub’s big complaint with current age-verification laws is that these laws are hard to enforce and seem to make it riskier than ever to visit an adult site.

“Since age verification software requires users to hand over extremely sensitive information, it opens the door for the risk of data breaches,” Pornhub’s blog said. “Whether or not your intentions are good, governments have historically struggled to secure this data. It also creates an opportunity for criminals to exploit and extort people through phishing attempts or fake [age verification] processes, an unfortunate and all too common practice.”

Over the past few years, the risk of identity theft or stolen PII on both widely used and smaller niche adult sites has been well-documented.

Hundreds of millions of people were impacted by major leaks exposing PII shared with popular adult sites like Adult Friend Finder and Brazzers in 2016, while likely tens of thousands of users were targeted on eight poorly secured adult sites in 2018. Niche and free sites have also been vulnerable to attacks, including millions collectively exposed through breaches of fetish porn site Luscious in 2019 and MyFreeCams in 2021.

And those are just the big breaches that make headlines. In 2019, Kaspersky Lab reported that malware targeting online porn account credentials more than doubled in 2018, and researchers analyzing 22,484 pornography websites estimated that 93 percent were leaking user data to a third party.

That’s why Pornhub argues that, as states have passed age-verification laws requiring ID, they’ve “introduced harm” by redirecting visitors to adult sites that have fewer privacy protections and worse security, allegedly exposing users to more threats.

As an example, Pornhub reported, traffic to Pornhub in Louisiana “dropped by approximately 80 percent” after their age-verification law passed. That allegedly showed not just how few users were willing to show an ID to access their popular platform, but also how “very easily” users could simply move to “pirate, illegal, or other non-compliant sites that don’t ask visitors to verify their age.”

Pornhub has continued to argue that states passing laws like Louisiana’s cannot effectively enforce the laws and are simply shifting users to make riskier choices when accessing porn.

“The Louisiana law and other copycat state-level laws have no regulator, only civil liability, which results in a flawed enforcement regime, effectively making it an option for platform operators to comply,” Pornhub’s blog said. As one of the world’s most popular adult platforms, Pornhub would surely be targeted for enforcement if found to be non-compliant, while smaller adult sites perhaps plagued by security risks and disincentivized to check IDs would go unregulated, the thinking goes.

Aylo’s spokesperson shared 2023 Similarweb data with Ars, showing that sites complying with age-verification laws in Virginia, including Pornhub and xHamster, lost substantial traffic while seven non-compliant sites saw a sharp uptick in traffic. Similar trends were observed in Google trends data in Utah and Mississippi, while market shares were seemingly largely maintained in California, a state not yet checking IDs to access adult sites.

https://arstechnica.com/?p=2032654

Meta got hit Tuesday with a lawsuit alleging that the company knowingly overlooks sexist treatment of female employees. That includes an apparent practice of hiring and promoting less qualified men to roles over more qualified female applicants.

The complaint was filed in a US district court in New York by Jeffrey Smith, an engineer who joined Meta in 2018. Smith alleged that Meta was on the brink of promoting him when suddenly his “upward trajectory stopped” after he started speaking up about allegedly misogynistic management practices at Meta.

Smith claimed that instead of a promotion, his Meta manager, Sacha Arnaud, suggested that he resign shortly after delivering Smith’s first-ever negative performance review, which reduced his bonus payout and impacted his company stock. Smith has alleged he suffered emotional distress and economic injury due to this alleged retaliation.

“Punished almost immediately”

The engineer—whose direct reports consider him to be “pro-active” and “the most thoughtful manager” ever, the complaint noted—started protesting Meta’s treatment of women in the summer of 2023.

For Smith, the tipping point toward advocating for women at Meta came when an “exceedingly capable female Meta employee” had her role downsized during a company reorganization. Some of her former responsibilities were allocated to two male employees, one of which Smith considered “a particularly poor fit,” because the male employee had significantly less experience than the female employee and no experience managing other managers.

After that, Smith learned about a Meta research scientist, Ran Rubin, who allegedly evaluated “a high-performing” female employee’s work “more critically than men’s work.”

Smith said that he repeatedly raised concerns about the perceived sexist management with Meta’s human resources and leadership, but nothing came of it.

Instead of prompting Meta to intervene, Smith was overwhelmed as more women came forward, revealing what he considered “a pattern of neglectful management” at Meta, routinely providing “overly critical feedback” and exhibiting “bias against the women.”  Three women specifically complained about Rubin, who allegedly provided poor management and “advocated for white men to have supervision” over the women whose competence he “denigrated.”

“Rubin’s comments about each of these women was not based on any evidence, and all had significant experience and no complaints against them,” Smith’s complaint said.

As Smith tells it, he couldn’t help but speak up after noticing “a qualified female employee was inexplicably stripped of responsibilities, a male supervisor was hyper-critical of a female direct report, certain male managers exhibited bias towards women they oversaw and that Meta exhibited systematic preferential treatment towards men in promotions and ratings, while failing to provide career development support to women,” his complaint said.

Smith alleged that Meta “punished” him “almost immediately” after he spoke up for these women. Rather than incorporate employee feedback into his performance review, his manager took the “highly unusual” step of skipping a formal review and instead delivering an informal critical review.

Meta accused of “driving women away”

“Smith felt intimidated,” the complaint said, and he stopped reporting alleged mistreatment of women for a short period. But in October 2023, “Smith decided that he could not stay silent any longer,” resuming his criticism of Meta’s allegedly sexist male managers with gusto. Some women had left Meta over the alleged treatment, and once again, he felt he ought to be “voicing his concerns that the actions of Rubin and other managers were driving women away from Meta by treating them unequally.”

Weeks later, Smith received a negative annual performance review, but that didn’t stop him from raising a red flag when he learned that a manager intended to fill a research science manager role “with a junior white man.”

Smith told his manager that “the two most qualified people for the role” were “both women and were not being considered,” Smith’s complaint said. But allegedly, his manager “responded by lashing out” and “questioning whether Smith’s response was ‘productive.'” After that, another employee accused of acting “disrespectfully” toward women “yelled at and insulted Smith,” while everyday workplace activity like taking previously approved time off suddenly seemed to negatively impact his performance review.

Ultimately, “no action was ever taken regarding his complaints about Mr. Rubin or the culture at Meta,” Smith’s complaint said, but his manager suggested that he “search for a new job internally” before later “stating that Smith should consider resigning his role.”

Smith hopes a jury will agree that Meta violated anti-retaliation and anti-interference laws in New York. A victory could result in civil and punitive damages compensating Smith for harm to his “professional and personal reputations and loss of career fulfillment.” It could also block Meta from any further mistreatment of women in the workplace, as alleged in the complaint.

An attorney for Smith, Valdi Licul, provided Ars with a statement, characterizing Smith’s case as “yet another example of how major corporations are failing to address sexist cultures and how they try to silence those who speak out against their practices. We look forward to holding Meta accountable and making it clear that sexism has no place in the workforce.”

Meta did not immediately respond to Ars’ request to comment.

https://arstechnica.com/?p=2032420

AT&T is imposing $10 and $20 monthly price hikes on users of older unlimited wireless plans starting in August 2024, the company announced. The single-line price of these 10 “retired” plans will increase by $10 per month, while customers with multiple lines on a plan will be hit with a total monthly increase of $20.

“If you have a single line of service on your plan, your monthly plan charge will increase by $10. If you have multiple lines on your plan, your monthly plan charge will increase by a total of $20. This is the total monthly increase, not per line increase,” AT&T said.

AT&T has offered a dizzying array of “unlimited” data plans over the years, all with different limits and perks. While unlimited plans let customers avoid overage fees, speeds can be slowed once customers hit their high-speed data limit. There are also limits on the usage of hotspot data.

The $10 and $20 price increases “affect most of our older unlimited plans,” AT&T said. The list of affected plans is as follows:

• • AT&T Unlimited & More Premium
  • AT&T Unlimited Choice Enhanced
  • AT&T Unlimited & More
  • AT&T Unlimited Choice II
  • AT&T Unlimited Plus
  • AT&T Unlimited Choice
  • AT&T Unlimited Plan
  • AT&T Unlimited Plus Enhanced
  • AT&T Unlimited Value Plan
  • AT&T Unlimited Plan (with TV)

AT&T softens blow with more high-speed data

To soften the blow of the price increase, AT&T said it would let customers who keep their older plans have more high-speed data and hotspot data:

AT&T Unlimited Choice, Choice II, Choice Enhanced, Unlimited & More, and Unlimited Value plans will now include 75GB of high-speed data and 30GB of hotspot data. AT&T Unlimited Plus, Plus Enhanced, Unlimited &More Premium, and AT&T Unlimited (with TV) plans will now include 100GB of high-speed data and 60GB of hotspot data.

Customers may get a better price by switching to one of AT&T’s current unlimited plans, which range from $66 to $86 for a single line before taxes and fees. In 2019, as we wrote at the time, Unlimited & More cost $70 per month for one line while Unlimited & More Premium cost $80 per month for a single line.

The Unlimited & More plans replaced Unlimited Plus and Unlimited Choice in 2018. The 2018 change resulted in AT&T’s entry-level unlimited plan starting at $70 instead of the previous $65. All those plans are affected by the price increase slated for August 2024.

Unlimited & More originally didn’t have any set amount of high-speed data. Instead, that plan was subject to reduced speeds during times of network congestion regardless of how much data the customer used. The more expensive Unlimited & More Premium was given 22GB of high-speed data before possible slowdowns.

Unlimited & More originally did not allow mobile hotspot usage, while Unlimited & More Premium allowed 15GB of high-speed mobile hotspot use. The new increases to high-speed data and hotspot allotments make these older plans behave a bit more like AT&T’s current mid-range and high-end plans.

Limits on current “unlimited” plans

Before deciding whether to switch to a current plan, AT&T customers should examine their limits. For the current entry-level plan titled “AT&T Unlimited Starter SL,” which costs $66 for a single line, AT&T says it “may temporarily slow data speeds if the network is busy” regardless of how much data you’ve used.

The current mid-range offering, AT&T Unlimited Extra EL, is $76 for a single line and comes with 75GB of smartphone data before possible slowdowns. The high-end Unlimited Premium PL, which is $86 for a single line, does not have slowdowns based on the amount of smartphone data you’ve used.

The above limits don’t apply to hotspot data, which is handled separately. Unlimited Premium PL comes with 60GB of high-speed hotspot data, the mid-range plan has 30GB of high-speed hotspot data, and the entry-level plan has 5GB of high-speed hotspot data. On all three plans, hotspot speeds are slowed to a maximum of 128 kbps once customers use the allotment.

AT&T’s price hike on older plans follows a similar move by T-Mobile. But unlike T-Mobile, AT&T didn’t promise that it would never raise prices on these plans.

https://arstechnica.com/?p=2032366

Elon Musk is still frantically pushing to launch X payment services in the US by the end of 2024, Bloomberg reported Tuesday.

Launching payment services is arguably one of the reasons why Musk paid so much to acquire Twitter in 2022. His rebranding of the social platform into X revives a former dream he had as a PayPal co-founder who fought and failed to name the now-ubiquitous payments app X. Musk has told X staff that transforming the company into a payments provider would be critical to achieving his goal of turning X into a so-called everything app “within three to five years.”

Late last year, Musk said it would “blow” his “mind” if X didn’t roll out payments by the end of 2024, so Bloomberg’s report likely comes as no big surprise to Musk’s biggest fans who believe in his vision. At that time, Musk said he wanted X users’ “entire financial lives” on the platform before 2024 ended, and a Bloomberg review of “more than 350 pages of documents and emails related to money transmitter licenses that X Payments submitted in 11 states” shows approximately how close he is to making that dream a reality on his platform.

X Payments, a subsidiary of X, reports that X already has money transmitter licenses in 28 states, but X wants to secure licenses in all states before 2024 winds down, Bloomberg reported.

Bloomberg’s review found that X has a multiyear plan to gradually introduce payment features across the US—including “Venmo-like” features to send and receive money, as well as make purchases online—but hopes to begin that process this year. Payment providers like Stripe and Adyen have already partnered with X to process its transactions, Bloomberg reported, and X has told regulators that it “anticipated” that its payments system would also rely on those partnerships.

Musk initially had hoped to launch payments globally in 2024, but regulatory pressures forced him to tamp down those ambitions, Bloomberg reported. States like Massachusetts, for example, required X to resubmit its application only after more than half of US states had issued licenses, Bloomberg found.

Ultimately, Musk wants X to become the largest financial institution in the world. Bloomberg reported that he plans to do this by giving users a convenient “digital dashboard” through X “that will serve as a centralized hub for all payments activity” online. To make sure that users keep their money stashed on the platform, Musk plans to offer “extremely high yield” savings accounts that X Payments’ chief information security officer, Chris Stanley, teased in April would basically guarantee that funds are rarely withdrawn from X.

“The end goal is if you ever have any incentive to take money out of our system, then we have failed,” Stanley posted on X.

Stanley compared X payments to Venmo and Apple Pay and said X’s plan for its payment feature was to “evolve” so that X users “can gain interest, buy products,” and “eventually use it to buy things in stores.”

Bloomberg confirmed that X does not plan to charge users any fees to send or receive payments, although Musk has told regulators that offering payments will “boost” X’s business by increasing X users’ “participation and engagement.” Analysts told Bloomberg that X could also profit off payments by charging merchants fees or by “offering banking services, such as checking accounts and debit cards.”

Musk has told X staff that he plans to offer checking accounts, debit cards, and even loans through X, saying that “if you address all things that you want from a finance standpoint, then we will be the people’s financial institution.”

X CEO Linda Yaccarino has been among the biggest cheerleaders for Musk’s plan to turn X into a bank, writing in a blog last year, “We want money on X to flow as freely as information and conversation.”

https://arstechnica.com/?p=2032306

T-Mobile has agreed to change its advertising for the “Price Lock” guarantee that doesn’t actually lock in a customer’s price, but continues to defend the offer.

T-Mobile users expressed their displeasure about being hit with up to $5 per-line price hikes on plans that seemed to have a lifetime price guarantee, but it was a challenge by AT&T that forced T-Mobile to agree to change its advertising. AT&T filed the challenge with the advertising industry’s self-regulatory group, which ruled that T-Mobile’s Price Lock ads were misleading.

As we’ve reported, T-Mobile’s guarantee (currently called “Price Lock” and previously the “Un-contract”) is simply a promise that T-Mobile will pay your final month’s bill if the carrier raises your price and you decide to cancel. Despite that, T-Mobile promised users that it “will never change the price you pay” if you’re on a plan with the provision.

BBB National Programs’ National Advertising Division (NAD), the ad industry’s self-regulatory body, ruled against T-Mobile in a decision issued yesterday. BBB National Programs is an independent nonprofit that is affiliated with the International Association of Better Business Bureaus.

The NAD’s decisions aren’t binding, but advertisers usually comply with them. That’s what T-Mobile is doing.

“T-Mobile is proud of its innovative Price Lock policy, where customers can get their last month of service on T-Mobile if T-Mobile ever changes the customer’s price, and the customer decides to leave,” the company said in its official response to the NAD’s decision. “While T-Mobile believes the challenged advertisements appropriately communicate the generous terms of its Price Lock policy, T-Mobile is a supporter of self-regulation and will take NAD’s recommendations to clarify the terms of its policy into account with respect to its future advertising.”

AT&T: Price Lock not a real price lock

While our recent reports on Price Lock concerned mobile plans, the ads challenged by AT&T were for T-Mobile’s 5G home Internet service.

“AT&T argued that the ‘Price Lock’ claims are false because T-Mobile is not committing to locking the pricing of its service for any amount of time,” the NAD’s decision said. “AT&T also argued that T-Mobile’s disclosures contradict the ‘Price Lock’ claim because they set forth limitations which make clear that T-Mobile may increase the price of service for any reason at any time.”

T-Mobile countered “that its home Internet service ‘price lock’ is innovative and unique in the industry, serving as a strong disincentive to T-Mobile against raising prices and offering a potential benefit of free month’s service, and that it has the discretion as to how to define a ‘price lock’ so long as it clearly communicates the terms,” the NAD noted.

AT&T challenged print and online ads, and a TV commercial featuring actors Zach Braff, Donald Faison, and Jason Momoa. The ads displayed a $50 monthly rate with the text “Price Lock” and included language clarifying the actual details of the offer.

The NAD said that “impactful claims about pricing policies require clear communication of what those policies are and cannot leave consumers with a fundamental misunderstanding about what those policies mean.” T-Mobile’s ads created a fundamental misunderstanding, the NAD found.

https://arstechnica.com/?p=2032223

Apple has abruptly discontinued its “buy now, pay later” (BNPL) service, Apple Pay Later, which turned Apple into a money lender when it launched last March in the US and became widely available in October.

The service previously allowed users to split the cost of purchases of up to $1,000 into four installments that were repaid over six weeks without worrying about extra fees or paying interest. For Apple, it was likely a move to increase total Apple Pay users as the company sought to offer more core financial services through its devices.

Now, it appears that Apple has found a different route to offer short-term loans at checkout in Apple Pay. An Apple spokesperson told 9to5Mac that the decision to end Apple Pay Later came ahead of the company’s plan to start offering new types of installment loans globally.

“Starting later this year, users across the globe will be able to access installment loans offered through credit and debit cards, as well as lenders, when checking out with Apple Pay,” Apple’s spokesperson said. “With the introduction of this new global installment loan offering, we will no longer offer Apple Pay Later in the US.”

Apple also noted its decision to kill off the service on a support page posted Monday, confirming that “Apple Pay Later is no longer offering new loans.” Apple specified that all “existing Apple Pay Later loans and purchases are not affected,” and loans can continue to be managed through users’ wallets.

One of the biggest challenges for BNPL customers is often seeking a refund for returned purchases, but Apple has assured Apple Pay Later customers that the refund process has not changed for any existing purchases. Customers can contact Apple Support if they have “trouble with a refund,” Apple’s support page said.

Apple announced its new installment loan program at its recent annual developer event, confirming that it had partnered with banks, including Citi in the US, to provide short-term loans as a payment option in its upcoming iOS 18 operating system due out before the end of 2024. Apple’s spokesperson told 9to5Mac that unlike Apple Pay Later, which was only available in the US, installment loans will be an option offered in more countries.

“Our focus continues to be on providing our users with access to easy, secure, and private payment options with Apple Pay, and this solution will enable us to bring flexible payments to more users, in more places across the globe, in collaboration with Apple Pay enabled banks and lenders,” Apple’s spokesperson said.

In a blog post, Apple described new features “available for any Apple Pay-enabled bank or issuer to integrate in supported markets.” These features allow users to “view and redeem rewards, and access installment loan offerings from eligible credit or debit cards, when making a purchase online or in-app with iPhone and iPad,” the blog said. For users in the US, Apple will soon make it easy to “apply for loans directly through Affirm when they check out with Apple Pay.”

A brief history of short-lived Apple Pay Later

The iPhone maker rolled out Apple Pay Later in March 2023, just after BNPL services fell under scrutiny by regulators globally, The Verge reported in 2022. Early studies found that “BNPL users are twice as likely to overdraft” and estimated that 43 percent of younger BNPL users have missed a payment.

A fear quickly arose that Apple Pay Later might “normalize” reliance on BNPL lending for frivolous large purchases that customers might then struggle to repay, The Verge reported. BNPL had already become hugely popular with Gen Z shoppers eager to purchase the latest TikTok fashions they may not otherwise be able to afford, The Verge noted.

In 2021, the US Consumer Financial Protection Bureau (CFPB) launched an inquiry into BNPL, flagging emerging potential consumer risks in 2022. Those included privacy risks from data harvesting and excessive debt accumulation from frequently reported borrower overextension.

However, despite emerging concerns about BNPL, Apple Pay Later was immediately popular, according to a JD Power survey of 8,000 consumers. In the first three months that the service was available, nearly one-fifth of BNPL customers used Apple Pay Later. With its BNPL offering, Apple attracted new customers who were interested in trying a new BNPL service from a trusted brand, JD Power reported, posing an immediate threat to BNPL services offered by “traditional payments juggernauts” like PayPal.

At that time, Apple was well-positioned to provide short-term loans, JD Power reported, finding that the “average Apple Pay Later user tended to be more financially healthy than most other BNPL customers, potentially giving it a more sustainable user base than its competitors.”

https://arstechnica.com/?p=2032164

Adobe prioritized profits while spending years ignoring numerous complaints from users struggling to cancel costly subscriptions without incurring hefty hidden fees, the US Federal Trade Commission (FTC) alleged in a lawsuit Monday.

According to the FTC, Adobe knew that canceling subscriptions was hard but determined that it would hurt revenue to make canceling any easier, so Adobe never changed the “convoluted” process. Even when the FTC launched a probe in 2022 specifically indicating that Adobe’s practices may be illegal, Adobe did nothing to address the alleged harm to consumers, the FTC complaint noted. Adobe also “provides no refunds or only partial refunds to some subscribers who incur charges after an attempted, unsuccessful cancellation.”

Adobe “repeatedly decided against rectifying some of Adobe’s unlawful practices because of the revenue implications,” the FTC alleged, asking a jury to permanently block Adobe from continuing the seemingly deceptive practices.

Dana Rao, Adobe’s general counsel and chief trust officer, provided a statement confirming to Ars that Adobe plans to defend its business practices against the FTC’s claims.

“Subscription services are convenient, flexible, and cost-effective to allow users to choose the plan that best fits their needs, timeline, and budget,” Rao said. “Our priority is to always ensure our customers have a positive experience. We are transparent with the terms and conditions of our subscription agreements and have a simple cancellation process. We will refute the FTC’s claims in court.”

Cancellation fee allegedly used as retention tool

The government’s heavily redacted complaint laid out Adobe’s alleged scheme, which starts with “manipulative enrollment practices.”

To lock subscribers into recurring monthly payments, Adobe would typically pre-select by default its most popular “annual paid monthly” plan, the FTC alleged. That subscription option locked users into an annual plan despite paying month to month. If they canceled after a two-week period, they’d owe Adobe an early termination fee (ETF) that costs 50 percent of their remaining annual subscription. The “material terms” of this fee are hidden during enrollment, the FTC claimed, only appearing in “disclosures that are designed to go unnoticed and that most consumers never see.”

For individual users, accessing Adobe’s suite of apps can cost more than $700 annually, Bloomberg reported. For many users suddenly faced with paying an ETF worth hundreds while losing access to services instantly, the decision to cancel is not as straightforward as it might be without the hidden fee. the FTC alleged.

Because Adobe allegedly only alerted users to the ETF in fine print—by hovering over a small icon or clicking a hyperlink in small text—while the company’s cancellation flows made it hard to end recurring payments, the FTC is suing and accusing Adobe of deceptive practices under the FTC Act.

Additionally, Adobe’s “stealth ETF” may violate the Restore Online Shoppers’ Confidence Act (ROSCA), the FTC alleged.

Under ROSCA, Adobe’s ETF could be considered a “negative feature option” because Adobe allegedly does not clearly disclose the ETF during subscription sign-ups. Therefore, Adobe only gets a customer to agree to pay the ETF through their “silence or failure to take an affirmative action to reject goods or services or to cancel the agreement.”

ROSCA only permits online businesses to charge for goods or services through a negative feature option under certain conditions. In Adobe’s case, the ETF would’ve needed to be clearly disclosed prior to collecting billing information. Otherwise, the customer should have been asked to give informed consent, or Adobe should have provided “simple mechanisms to stop recurring charges.”

Adobe did none of that, the FTC alleged, failing to provide “a simple way” to end subscriptions and harming customers who were “ambushed” by ETFs that “can sometimes be several hundred dollars.”

https://arstechnica.com/?p=2032021

US Surgeon General Vivek Murthy wants to put a warning label on social media platforms, alerting young users of potential mental health harms.

“It is time to require a surgeon general’s warning label on social media platforms stating that social media is associated with significant mental health harms for adolescents,” Murthy wrote in a New York Times op-ed published Monday.

Murthy argued that a warning label is urgently needed because the “mental health crisis among young people is an emergency,” and adolescents overusing social media can increase risks of anxiety and depression and negatively impact body image.

Spiking mental health issues for young people began long before the surgeon general declared a youth behavioral health crisis during the pandemic, an April report from a New York nonprofit called the United Health Fund found. Between 2010 and 2022, “adolescents ages 12–17 have experienced the highest year-over-year increase in having a major depressive episode,” the report said. By 2022, 6.7 million adolescents in the US were reporting “suffering from one or more behavioral health condition.”

However, mental health experts have maintained that the science is divided, showing that kids can also benefit from social media depending on how they use it. Murthy’s warning label seems to ignore that tension, prioritizing raising awareness of potential harms even though parents potentially restricting online access due to the proposed label could end up harming some kids. The label also would seemingly fail to acknowledge known risks to young adults, whose brains continue developing after the age of 18.

To create the proposed warning label, Murthy is seeking better data from social media companies that have not always been transparent about studying or publicizing alleged harms to kids on their platforms. Last year, a Meta whistleblower, Arturo Bejar, testified to a US Senate subcommittee that Meta overlooks obvious reforms and “continues to publicly misrepresent the level and frequency of harm that users, especially children, experience” on its platforms Facebook and Instagram.

According to Murthy, the US is past the point of accepting promises from social media companies to make their platforms safer. “We need proof,” Murthy wrote.

“Companies must be required to share all of their data on health effects with independent scientists and the public—currently they do not—and allow independent safety audits,” Murthy wrote, arguing that parents need “assurance that trusted experts have investigated and ensured that these platforms are safe for our kids.”

“A surgeon general’s warning label, which requires congressional action, would regularly remind parents and adolescents that social media has not been proved safe,” Murthy wrote.

Kids need safer platforms, not a warning label

Leaving parents to police kids’ use of platforms is unacceptable, Murthy said, because their efforts are “pitted against some of the best product engineers and most well-resourced companies in the world.”

That is nearly an impossible battle for parents, Murthy argued. If platforms are allowed to ignore harms to kids while pursuing financial gains by developing features that are laser-focused on maximizing young users’ online engagement, platforms will “likely” perpetuate the cycle of problematic use that Murthy described in his op-ed, the American Psychological Association (APA) warned this year.

Downplayed in Murthy’s op-ed, however, is the fact that social media use is not universally harmful to kids and can be beneficial to some, especially children in marginalized groups. Monitoring this tension remains a focal point of the APA’s most recent guidance, which noted that in April 2024 that “society continues to wrestle with ways to maximize the benefits of these platforms while protecting youth from the potential harms associated with them.”

“Psychological science continues to reveal benefits from social media use, as well as risks and opportunities that certain content, features, and functions present to young social media users,” APA reported.

According to the APA, platforms urgently need to enact responsible safety standards that diminish risks without restricting kids’ access to beneficial social media use.

“By early 2024, few meaningful changes to social media platforms had been enacted by industry, and no federal policies had been adopted,” the APA report said. “There remains a need for social media companies to make fundamental changes to their platforms.”

The APA has recommended a range of platform reforms, including limiting infinite scroll, imposing time limits on young users, reducing kids’ push notifications, and adding protections to shield kids from malicious actors.

Bejar agreed with the APA that platforms owe it to parents to make meaningful reforms. His ideal future would see platforms gathering more granular feedback from young users to expose harms and confront them faster. He provided senators with recommendations that platforms could use to “radically improve the experience of our children on social media” without “eliminating the joy and value they otherwise get from using such services” and without “significantly” affecting profits.

Bejar’s reforms included platforms providing young users with open-ended ways to report harassment, abuse, and harmful content that allow users to explain exactly why a contact or content was unwanted—rather than platforms limiting feedback to certain categories they want to track. This could help ensure that companies that strategically limit language in reporting categories don’t obscure the harms and also provide platforms with more information to improve services, Bejar suggested.

By improving feedback mechanisms, Bejar said, platforms could more easily adjust kids’ feeds to stop recommending unwanted content. The APA’s report agreed that this was an obvious area for platform improvement, finding that “the absence of clear and transparent processes for addressing reports of harmful content makes it harder for youth to feel protected or able to get help in the face of harmful content.”

Ultimately, the APA, Bejar, and Murthy all seem to agree that it is important to bring in outside experts to help platforms come up with better solutions, especially as technology advances. The APA warned that “AI-recommended content has the potential to be especially influential and hard to resist” for some of the youngest users online (ages 10–13).

https://arstechnica.com/?p=2031954

An Indiana cop has resigned after it was revealed that he frequently used Clearview AI facial recognition technology to track down social media users not linked to any crimes.

According to a press release from the Evansville Police Department, this was a clear “misuse” of Clearview AI’s controversial face scan tech, which some US cities have banned over concerns that it gives law enforcement unlimited power to track people in their daily lives.

To help identify suspects, police can scan what Clearview AI describes on its website as “the world’s largest facial recognition network.” The database pools more than 40 billion images collected from news media, mugshot websites, public social media, and other open sources.

But these scans must always be linked to an investigation, and Evansville police chief Philip Smith said that instead, the disgraced cop repeatedly disguised his personal searches by deceptively “utilizing an actual case number associated with an actual incident” to evade detection.

Smith’s department discovered the officer’s unauthorized use after performing an audit before renewing their Clearview AI subscription in March. That audit showed “an anomaly of very high usage of the software by an officer whose work output was not indicative of the number of inquiry searches that they had.”

Another clue to the officer’s abuse of the tool was that most face scans conducted during investigations are “usually live or CCTV images”—shots taken in the wild—Smith said. However, the officer who resigned was mainly searching social media images, which was a red flag.

An investigation quickly “made clear that this officer was using Clearview AI” for “personal purposes,” Smith said, declining to name the officer or verify if targets of these searchers were notified.

As a result, Smith recommended that the department terminate the officer. However, the officer resigned “before the Police Merit Commission could make a final determination on the matter,” Smith said.

Easily dodging Clearview AI’s built-in compliance features

Clearview AI touts the face image network as a public safety resource, promising to help law enforcement make arrests sooner while committing to “ethical and responsible” use of the tech.

On its website, the company says that it understands that “law enforcement agencies need built-in compliance features for increased oversight, accountability, and transparency within their jurisdictions, such as advanced admin tools, as well as user-friendly dashboards, reporting, and metrics tools.”

To “help deter and detect improper searches,” its website says that a case number and crime type is required, and “every agency is required to have an assigned administrator that can see an in-depth overview of their organization’s search history.”

It seems that neither of those safeguards stopped the Indiana cop from repeatedly scanning social media images for undisclosed personal reasons, seemingly rubber-stamping the case number and crime type requirement and going unnoticed by his agency’s administrator. This incident could have broader implications in the US, where its technology has been widely used by police to conduct nearly 1 million searches, Clearview AI CEO Hoan Ton-That told the BBC last year.

In 2022, Ars reported when Clearview AI told investors it had ambitions to collect more than 100 billion face images, ensuring that “almost everyone in the world will be identifiable.” As privacy concerns about the controversial tech mounted, it became hotly debated. Facebook moved to stop the company from scraping faces on its platform, and the ACLU won a settlement that banned Clearview AI from contracting with most businesses. But the US government retained access to the tech, including “hundreds of police forces across the US,” Ton-That told the BBC.

Most law enforcement agencies are hesitant to discuss their Clearview AI tactics in detail, the BBC reported, so it’s often unclear who has access and why. But the Miami Police confirmed that “it uses this software for every type of crime,” the BBC reported.

Now, at least one Indiana police department has confirmed that an officer can sneakily abuse the tech and conduct unapproved face scans with apparent ease.

According to Kashmir Hill—the journalist who exposed Clearview AI’s tech—the disgraced cop was following in the footsteps of “billionaires, Silicon Valley investors, and a few high-wattage celebrities” who got early access to Clearview AI tech in 2020 and considered it a “superpower on their phone, allowing them to put a name to a face and dig up online photos of someone that the person might not even realize were online.”

Advocates have warned that stronger privacy laws are needed to stop law enforcement from abusing Clearview AI’s network, which Hill described as “a Shazam for people.”

Smith said the officer disregarded department guidelines by conducting the improper face scans.

“To ensure that the software is used for its intended purposes, we have put in place internal operational guidelines and adhere to the Clearview AI terms of service,” Smith said. “Both have language that clearly states that this is a tool for official use and is not to be used for personal reasons.

https://arstechnica.com/?p=2031338