Former and current OpenAI employees received a memo this week that the AI company hopes to end the most embarrassing scandal that Sam Altman has ever faced as OpenAI’s CEO.

The memo finally clarified for employees that OpenAI would not enforce a non-disparagement contract that employees since at least 2019 were pressured to sign within a week of termination or else risk losing their vested equity. For an OpenAI employee, that could mean losing millions for expressing even mild criticism about OpenAI’s work.

You can read the full memo below in a post on X (formerly Twitter) from Andrew Carr, a former OpenAI employee whose LinkedIn confirms that he left the company in 2021.

“I guess that settles that,” Carr wrote on X.

OpenAI faced a major public backlash when Vox revealed the unusually restrictive language in the non-disparagement clause last week after OpenAI co-founder and chief scientist Ilya Sutskever resigned, along with his superalignment team co-leader Jan Leike.

As questions swirled regarding these resignations, the former OpenAI staffers provided little explanation for why they suddenly quit. Sutskever basically wished OpenAI well, expressing confidence “that OpenAI will build AGI that is both safe and beneficial,” while Leike only offered two words: “I resigned.”

Amid an explosion of speculation about whether OpenAI was perhaps forcing out employees or doing dangerous or reckless AI work, some wondered if OpenAI’s non-disparagement agreement was keeping employees from warning the public about what was really going on at OpenAI.

According to Vox, employees had to sign the exit agreement within a week of quitting or else potentially lose millions in vested equity that could be worth more than their salaries. The extreme terms of the agreement were “fairly uncommon in Silicon Valley,” Vox found, allowing OpenAI to effectively censor former employees by requiring that they never criticize OpenAI for the rest of their lives.

“This is on me and one of the few times I’ve been genuinely embarrassed running OpenAI,” Altman posted on X, while claiming, “I did not know this was happening and I should have.”

Vox reporter Kelsey Piper called Altman’s apology “hollow,” noting that Altman had recently signed separation letters that seemed to “complicate” his claim that he was unaware of the harsh terms. Piper reviewed hundreds of pages of leaked OpenAI documents and reported that in addition to financially pressuring employees to quickly sign exit agreements, OpenAI also threatened to block employees from selling their equity.

Even requests for an extra week to review the separation agreement, which could afford the employees more time to seek legal counsel, were seemingly denied—”as recently as this spring,” Vox found.

“We want to make sure you understand that if you don’t sign, it could impact your equity,” an OpenAI representative wrote in an email to one departing employee. “That’s true for everyone, and we’re just doing things by the book.”

OpenAI Chief Strategy Officer Jason Kwon told Vox that the company began reconsidering revising this language about a month before the controversy hit.

“We are sorry for the distress this has caused great people who have worked hard for us,” Kwon told Vox. “We have been working to fix this as quickly as possible. We will work even harder to be better.”

Altman sided with OpenAI’s biggest critics, writing on X that the non-disparagement clause “should never have been something we had in any documents or communication.”

“Vested equity is vested equity, full stop,” Altman wrote.

These long-awaited updates make clear that OpenAI will never claw back vested equity if employees leave the company and then openly criticize its work (unless both parties sign a non-disparagement agreement). Prior to this week, some former employees feared steep financial retribution for sharing true feelings about the company.

One former employee, Daniel Kokotajlo, publicly posted that he refused to sign the exit agreement, even though he had no idea how to estimate how much his vested equity was worth. He guessed it represented “about 85 percent of my family’s net worth.”

And while Kokotajlo said that he wasn’t sure if the sacrifice was worth it, he still felt it was important to defend his right to speak up about the company.

“I wanted to retain my ability to criticize the company in the future,” Kokotajlo wrote.

Even mild criticism could seemingly cost employees, like Kokotajlo, who confirmed that he was leaving the company because he was “losing confidence” that OpenAI “would behave responsibly” when developing generative AI.

In OpenAI’s defense, the company confirmed that it had never enforced the exit agreements. But now, OpenAI’s spokesperson told CNBC, OpenAI is backtracking and “making important updates” to its “departure process” to eliminate any confusion the prior language caused.

“We have not and never will take away vested equity, even when people didn’t sign the departure documents,” OpenAI’s spokesperson said. “We’ll remove non-disparagement clauses from our standard departure paperwork, and we’ll release former employees from existing non-disparagement obligations unless the non-disparagement provision was mutual.”

The memo sent to current and former employees reassured everyone at OpenAI that “regardless of whether you executed the Agreement, we write to notify you that OpenAI has not canceled, and will not cancel, any Vested Units.”

“We’re incredibly sorry that we’re only changing this language now; it doesn’t reflect our values or the company we want to be,” OpenAI’s spokesperson said.

https://arstechnica.com/?p=2026952

A Democratic consultant was indicted on charges of voter suppression and impersonation of a candidate after admitting that he commissioned a robocall that used artificial intelligence to imitate President Joe Biden’s voice. The political consultant, Steven Kramer, is also facing a $6 million fine proposed by the Federal Communications Commission.

The fake Biden robocall urged Democrats not to vote and was placed to New Hampshire residents before the state’s presidential primary in January. Kramer, who was working for a candidate running against Biden, acknowledged that he was responsible for the robocall in February.

Kramer, a 54-year-old from New Orleans, “has been charged with 13 felony counts of voter suppression… and 13 misdemeanor counts of impersonation of a candidate,” New Hampshire Attorney General John Formella announced today. “The charges are spread across four counties based on the residence of thirteen New Hampshire residents who received the Biden robocalls.”

Formella said his office is still investigating the incident. “New Hampshire remains committed to ensuring that our elections remain free from unlawful interference and our investigation into this matter remains ongoing,” he said.

Separately, the FCC today proposed a $6 million fine against Kramer in a Notice of Apparent Liability for Forfeiture. Kramer will be given a chance to respond before the FCC makes a final determination on the fine.

“Political consultant Steve Kramer was responsible for the calls,” which “apparently violated the Truth in Caller ID Act by maliciously spoofing the number of a prominent local political consultant,” the FCC said. “The robocalls, made two days prior to the election, used a deepfake of President Biden’s voice and encouraged voters to not vote in the primary but rather to ‘save your vote for the November election.'”

Kramer defended fake Biden call

Kramer defended his actions after his role was revealed by an NBC News article. “Kramer claimed he planned the fake robocall from the start as an act of civil disobedience to call attention to the dangers of AI in politics,” NBC News wrote in February after talking to Kramer. “He compared himself to American Revolutionary heroes Paul Revere and Thomas Paine. He said more enforcement is necessary to stop people like him from doing what he did.”

“This is a way for me to make a difference, and I have,” Kramer told NBC News in an interview. “For $500, I got about $5 million worth of action, whether that be media attention or regulatory action.”

Kramer was working as a consultant for Democrat Dean Phillips, a US representative from Minnesota who ran against Biden in the New Hampshire Democratic primary. Phillips suspended his long-shot presidential campaign in March.

“Phillips and his campaign have denounced the robocall, saying they had no knowledge of Kramer’s involvement and would have immediately terminated him if they had known,” NBC News wrote. Kramer also said that Phillips had nothing to do with the robocall.

In early February, the New Hampshire AG’s office said the robocall was traced to a Texas company called Life Corporation and a person named Walter Monk. But the AG’s office said it was “continuing to investigate whether Life Corporation worked with or at the direction of any other persons or entities.”

Texas-based phone company Lingo Telecom was found to have transmitted the calls and is now facing an FCC fine. the FCC today proposed a $2 million fine against Lingo Telecom for “incorrectly labeling [the calls] with the highest level of caller ID attestation and making it less likely that other providers could detect the calls as potentially spoofed.”

The FCC alleged that Lingo Telecom violated rules related to the STIR/SHAKEN Caller ID authentication system. “Lingo Telecom failed to follow ‘Know Your Customer’ principles by applying the highest level attestation—signifying trust in the caller ID information—to apparently illegally spoofed calls without making any effort to verify the accuracy of the information,” the FCC said.

https://arstechnica.com/?p=2026769

A proposed repeal of Section 230 is designed to punish Big Tech but is also facing opposition from library associations, the Internet Archive, the owner of Wikipedia, and advocacy groups from across the political spectrum who say a repeal is bad for online speech. Opposition poured in before a House hearing today on the bipartisan plan to “sunset” Section 230 of the Communications Decency Act, which gives online platforms immunity from lawsuits over how they moderate user-submitted content.

Lawmakers defended the proposed repeal. House Commerce Committee Ranking Member Frank Pallone, Jr. (D-N.J.) today said that “Section 230 has outlived its usefulness and has played an outsized role in creating today’s ‘profits over people’ Internet” and criticized what he called “Big Tech’s constant scare tactics about reforming Section 230.”

Pallone teamed up with Commerce Committee Chair Cathy McMorris Rodgers (R-Wash.) to propose the Section 230 repeal. The lawmakers haven’t come up with a replacement for the law, a tactic that some critics predict will lead to legislative chaos. A hearing memo said the draft bill “would sunset Section 230 of the Communications Act effective on December 31, 2025,” but claimed the “intent of the legislation is not to have Section 230 actually sunset, but to encourage all technology companies to work with Congress to advance a long-term reform solution to Section 230.”

McMorris Rodgers and Pallone wrote a Wall Street Journal op-ed alleging that “Big Tech companies are exploiting the law to shield them from any responsibility or accountability as their platforms inflict immense harm on Americans, especially children.”

While politicians are focused on Big Tech, one letter sent to lawmakers said the proposal “fails to recognize the indispensable role that Section 230 plays in fostering a diverse and innovative digital landscape across many industries that extends far beyond the realm of only large technology corporations.”

Library and Internet groups defend Section 230

The letter was sent by the American Library Association, the Association of Research Libraries, the Consumer Technology Association, Creative Commons, Educause, Incompas, the Internet Archive, the Internet Infrastructure Coalition, the Internet Society, and the Wikimedia Foundation.

Section 230 is essential for small and medium-sized tech businesses, educational institutions, libraries, ISPs, and many others, the letter said:

By narrowly framing the debate around the interests of “Big Tech,” there is a risk of misunderstanding the far-reaching implications of altering or dismantling Section 230. The heaviest costs and burdens of such action would fall on the millions of stakeholders we represent who, unlike large companies, do not have the resources to navigate a flood of content-based lawsuits. While it may seem that such changes will not “break the Internet,” this perspective overlooks the intricate interplay of legal liability and innovation that underpins the entire digital infrastructure.

Opposition this week also came from the Electronic Frontier Foundation, which said that “Section 230 is essential to protecting individuals’ ability to speak, organize, and create online.”

“The law is not a shield for Big Tech,” the EFF wrote. “Critically, the law benefits the millions of users who don’t have the resources to build and host their own blogs, email services, or social media sites, and instead rely on services to host that speech. Section 230 also benefits thousands of small online services that host speech. Those people are being shut out as the bill sponsors pursue a dangerously misguided policy.”

The EFF said it worries that if Big Tech helps Congress write a Section 230 replacement, the new law won’t “protect and benefit Internet users, as Section 230 does currently.”

https://arstechnica.com/?p=2026242

This June, approximately 150 motorcycles will thunder down Route 9W in Saugerties, New York, for Ryan’s Ride for Recovery. Organized by Vince Kelder and his family, the barbecue and raffle will raise money to support their sober-living facility and honor their son who tragically died from a heroin overdose in 2015 after a yearslong drug addiction.

The Kelders established Raising Your Awareness about Narcotics (RYAN) to help others struggling with substance-use disorder. For years, the organization has relied on Eventbrite, an event management and ticketing website, to arrange its events. This year, however, alongside listings for Ryan’s Ride and other addiction recovery events, Eventbrite surfaced listings peddling illegal sales of prescription drugs like Xanax, Valium, and oxycodone.

“It’s criminal,” Vince Kelder says. “They’re preying on people trying to get their lives back together.”

Eventbrite prohibits listings dedicated to selling illegal substances on its platform. It’s one of the 16 categories of content the company’s policies restrict its users from posting. But a WIRED investigation found more than 7,400 events published on the platform that appeared to violate one or more of these terms.

Among these listings were pages claiming to sell fentanyl powder “without a prescription,” accounts pushing the sale of Social Security numbers, and pages offering a “wild night with independent escorts” in India. Some linked to sites offering such wares as Gmail accounts, Google reviews (positive and negative), and TikTok and Instagram likes and followers, among other services.

At least 64 of the event listings advertising drugs included links to online pharmacies that the National Association of Boards of Pharmacy have flagged as untrustworthy or unsafe. Amanda Hils, a spokesperson for the US Food and Drug Administration, says the agency does not comment on individual cases without a thorough review, but broadly some online pharmacies that appear to look legitimate may be “operating illegally and selling medicines that can be dangerous or even deadly.”

Eventbrite didn’t just publish these user-generated event listings; its algorithms appeared to actively recommend them to people through simple search queries or in “related events”—a section at the bottom of an event’s page showing users similar events they might be interested in. As well as posts selling illegal prescription drugs in search results appearing next to the RYAN event, a search for “opioid” in the United States showed Eventbrite’s recommendation algorithm suggesting a conference for opioid treatment practitioners between two listings for ordering oxycodone.

Robin Pugh, the executive director of nonprofit cybercrime-fighting organization Intelligence for Good, which first alerted WIRED to some of the listings, says it is quick and easy to identify the illicit posts on Eventbrite and that other websites that allow “user-generated content” are also plagued by scammers uploading posts in similar ways.

https://arstechnica.com/?p=2026185

This article originally appeared on Inside Climate News, a nonprofit, independent news organization that covers climate, energy, and the environment. It is republished with permission. Sign up for their newsletter here. 

The Bureau of Land Management announced Thursday that it would no longer make federally managed lands in Wyoming’s Powder River Basin available for new coal mining leases, drawing condemnation from the fossil fuel industry in the region that produces the most coal in the country, but delivering a boon to the nation’s clean energy transition.

The Powder River Basin, a geological formation that covers much of northeast Wyoming and a portion of southeast Montana, has been the nation’s largest source of coal for decades, with production there peaking in 2008. Since then, demand for coal has plummeted, largely due to the rise of natural gas and renewable energy. Taking federal coal off the table in the basin could all but put an expiration date on the nation’s thermal coal industry.

“This is a really critical, and frankly long overdue step that BLM has taken,” said Melissa Hornbein, an attorney at the Western Environmental Law Center, which was part of the legal team that represented several environmental groups in two legal challenges to the Bureau of Land Management’s previous resource management plans for the area.

The decision to cease coal mining in the Powder River Basin is part of the BLM Buffalo Field Office’s Resource Management Plan (RMP), a sprawling document that lays out how the agency intends to cultivate the different uses for a strip of land under its jurisdiction near Gillette, Wyoming. Federal law requires the BLM to take a “multiple use” approach to its resource management plans, balancing resource extraction, conservation, and recreation.

Travis Deti, executive president of the Wyoming Mining Association, an industry group, called the BLM’s plan a “ridiculous assault on our coal industry,” in a prepared statement, and said “banning of further federal coal leasing will kill thousands of Wyoming jobs, put families in economic jeopardy, devastate the state’s revenue base and put the already rickety American electricity grid at greater risk of failure.”

The BLM has released two previous versions of its Buffalo RMP, under both the Obama and Trump administrations. In both cases, environmental groups felt the agency failed to consider the national environmental and health consequences of the mining and burning of millions more tons of coal over several decades. The groups successfully sued the agency over both plans.

In his decision regarding the first suit, handed down in 2018, US District Court Judge Brian Morris of Montana’s Great Falls Division sided with the environmental groups, saying the agency was obligated to analyze “the environmental consequences of downstream combustion of coal, oil, and gas open to development” as part of its planning process.

Now that the agency has considered the environmental impacts of combusting coal from the Powder River Basin, this was the “only scientifically defensible position” the agency could take, Hornbein said.

The BLM’s decision carries public health benefits, too, Hornbein continued. “The amount of savings in terms of sicknesses, premature birth, fetal brain damage, respiratory infections, and mortality is almost hard to quantify, but it’s really, really impactful,” she said.

During the suits that helped bring about the latest Buffalo resource management plan, environmental groups submitted expert testimony from Brian Moench, a former professor of public health and the environment at the University of Utah, who contended that mining and subsequently burning Powder River Basin coal would lead to tens of thousands of premature deaths nationwide, Hornbein said.

The BLM’s decision comes a few weeks after it updated its approach to land management, recognizing conservation “as an essential component of public lands management, on equal footing with other multiple uses of these lands,” the agency said.

Deti evoked the agency’s multiple-use mandate in his response to the updated Buffalo management plan, arguing that President Biden “and his radical environmental movement influencers are not only ignoring BLM’s multiple-use charge under the Federal Land Policy and Management Act, but are driving the country headlong into a significant energy crisis.”

While this decision will undoubtedly preserve some of the Powder River Basin’s landscape, Horbein believes it has more to do with the agency’s analysis of environmental and public health effects from coal mining. “The amendment itself was pretty narrowly tailored to address the deficiencies found by the federal district judge in the decision overturning BLM’s prior resource management plans,” she said.

Hornbein acknowledged that this new plan would alter the economies of coal communities, whose local budgets rely heavily on taxes paid by the industry. “That impact is not small,” she said, adding that the impact of declining tax revenues has been steadily growing in coal communities as demand for coal has decreased in the last two decades. Federal and local governments and coal companies all need to work together to minimize the financial effects of shuttering coal production, Hornbein said. “Communities are going to really need help.”

As of 2022, both industrial and commercial consumption of coal were down over 60 percent from the turn of the century, according to US Energy Information data.

Both Hornbein and Deti mentioned the possibility of a legal challenge to the BLM’s Buffalo resource management plan. “Wyoming’s policy leaders must combat this action forcefully with every legal and economic tool available,” Deti said. “The stakes could not be higher.”

“I’ll be surprised if there’s not a challenge,” said Hornbein.

Members of the public have until June 17 to submit comments on the final resource management plan.

https://arstechnica.com/?p=2025541

OpenAI has paused a voice mode option for ChatGPT-4o, Sky, after backlash accusing the AI company of intentionally ripping off Scarlett Johansson’s critically acclaimed voice-acting performance in the 2013 sci-fi film Her.

In a blog defending their casting decision for Sky, OpenAI went into great detail explaining its process for choosing the individual voice options for its chatbot. But ultimately, the company seemed pressed to admit that Sky’s voice was just too similar to Johansson’s to keep using it, at least for now.

“We believe that AI voices should not deliberately mimic a celebrity’s distinctive voice—Sky’s voice is not an imitation of Scarlett Johansson but belongs to a different professional actress using her own natural speaking voice,” OpenAI’s blog said.

OpenAI is not naming the actress, or any of the ChatGPT-4o voice actors, to protect their privacy.

A week ago, OpenAI CEO Sam Altman seemed to invite this controversy by posting “her” on X (formerly Twitter) after announcing the ChatGPT audio-video features that he said made it more “natural” for users to interact with the chatbot.

Altman has said that Her, a movie about a man who falls in love with his virtual assistant, is among his favorite movies. He told conference attendees at Dreamforce last year that the movie “was incredibly prophetic” when depicting “interaction models of how people use AI,” The San Francisco Standard reported. And just last week, Altman touted GPT-4o’s new voice mode by promising, “it feels like AI from the movies.”

But OpenAI’s chief technology officer, Mira Murati, has said that GPT-4o’s voice modes were less inspired by Her than by studying the “really natural, rich, and interactive” aspects of human conversation, The Wall Street Journal reported.

In 2013, of course, critics praised Johansson’s Her performance as expressively capturing a wide range of emotions, which is exactly what Murati described as OpenAI’s goals for its chatbot voices. Rolling Stone noted how effectively Johansson naturally navigated between “tones sweet, sexy, caring, manipulative, and scary.” Johansson achieved this, the Hollywood Reporter said, by using a “vivacious female voice that breaks attractively but also has an inviting deeper register.”

Her director/screenwriter Spike Jonze was so intent on finding the right voice for his film’s virtual assistant that he replaced British actor Samantha Morton late in the film’s production. According to Vulture, Jonze realized that Morton’s “maternal, loving, vaguely British, and almost ghostly” voice didn’t fit his film as well as Johansson’s “younger,” “more impassioned” voice, which he said brought “more yearning.”

Late-night shows had fun mocking OpenAI’s demo featuring the Sky voice. The demo showed the chatbot seemingly flirting with engineers, giggling through responses like “Oh, stop it. You’re making me blush.” Where The New York Times described these demo interactions as Sky being “deferential and wholly focused on the user,” The Daily Show‘s Desi Lydic joked that Sky was “clearly programmed to feed dudes’ egos.”

OpenAI is likely hoping to avoid any further controversy amid plans to roll out more voices soon that its blog said will “better match the diverse interests and preferences of users.”

OpenAI did not immediately respond to Ars’ request for comment.

Voice actors versus AI

The OpenAI controversy arrives at a moment when many are questioning AI’s impact on creative communities, triggering early lawsuits from artists and book authors. Just this month, Sony opted all of its artists out of AI training to stop voice clones from ripping off top talents like Adele and Beyoncé.

Voice actors, too, have been monitoring increasingly sophisticated AI voice generators, waiting to see what threat AI might pose to future work opportunities. Recently, two actors sued an AI startup called Lovo that they claimed “illegally used recordings of their voices to create technology that can compete with their voice work,” The New York Times reported. According to that lawsuit, Lovo allegedly used the actors’ actual voice clips to clone their voices.

“We don’t know how many other people have been affected,” the actors’ lawyer, Steve Cohen, told The Times.

Rather than replacing voice actors, OpenAI’s blog said that they are striving to support the voice industry when creating chatbots that will laugh at your jokes or mimic your mood. On top of paying voice actors “compensation above top-of-market rates,” OpenAI said they “worked with industry-leading casting and directing professionals to narrow down over 400 submissions” to the five voice options in the initial rollout of audio-video features.

Their goals in hiring voice actors were to hire talents “from diverse backgrounds or who could speak multiple languages,” casting actors who had voices that feel “timeless” and “inspire trust.” To OpenAI, that meant finding actors who have a “warm, engaging, confidence-inspiring, charismatic voice with rich tone” that sounds “natural and easy to listen to.”

For ChatGPT-4o’s first five voice actors, the gig lasted about five months before leading to more work, OpenAI said.

“We are continuing to collaborate with the actors, who have contributed additional work for audio research and new voice capabilities in GPT-4o,” OpenAI said.

Arguably, these actors are helping to train AI tools that could one day replace them, though. Backlash defending Johansson—one of the world’s highest-paid actors—perhaps shows that fans won’t take direct mimicry of any of Hollywood’s biggest stars lightly, though.

While criticism of the Sky voice seemed widespread, some fans think that OpenAI has overreacted by pausing the Sky voice.

NYT critic Alissa Wilkinson wrote that it was only “a tad jarring” to hear Sky’s voice because “she sounded a whole lot” like Johansson. And replying to OpenAI’s X post announcing its decision to pull the voice feature for now, a clump of fans protested the AI company’s “bad decision,” with some complaining that Sky was the “best” and “hottest” voice.

At least one fan noted that OpenAI’s decision seemed to hurt the voice actor behind Sky most.

“Super unfair for the Sky voice actress,” a user called Ate-a-Pi wrote. “Just because she sounds like ScarJo, now she can never make money again. Insane.”

https://arstechnica.com/?p=2025464

The Securities and Exchange Commission (SEC) will require some financial institutions to disclose security breaches within 30 days of learning about them.

On Wednesday, the SEC adopted changes to Regulation S-P, which governs the treatment of the personal information of consumers. Under the amendments, institutions must notify individuals whose personal information was compromised “as soon as practicable, but not later than 30 days” after learning of unauthorized network access or use of customer data. The new requirements will be binding on broker-dealers (including funding portals), investment companies, registered investment advisers, and transfer agents.

“Over the last 24 years, the nature, scale, and impact of data breaches has transformed substantially,” SEC Chair Gary Gensler said. “These amendments to Regulation S-P will make critical updates to a rule first adopted in 2000 and help protect the privacy of customers’ financial data. The basic idea for covered firms is if you’ve got a breach, then you’ve got to notify. That’s good for investors.”

Notifications must detail the incident, what information was compromised, and how those affected can protect themselves. In what appears to be a loophole in the requirements, covered institutions don’t have to issue notices if they establish that the personal information has not been used in a way to result in “substantial harm or inconvenience” or isn’t likely to.

The amendments will require covered institutions to “develop, implement, and maintain written policies and procedures” that are “reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information.” The amendments also:

• Expand and align the safeguards and disposal rules to cover both nonpublic personal information that a covered institution collects about its own customers and nonpublic personal information it receives from another financial institution about customers of that financial institution;
• Require covered institutions, other than funding portals, to make and maintain written records documenting compliance with the requirements of the safeguards rule and disposal rule;
• Conform Regulation S-P’s annual privacy notice delivery provisions to the terms of an exception added by the FAST Act, which provide that covered institutions are not required to deliver an annual privacy notice if certain conditions are met; and
• Extend both the safeguards rule and the disposal rule to transfer agents registered with the Commission or another appropriate regulatory agency.

The requirements also broaden the scope of nonpublic personal information covered beyond what the firm itself collects. The new rules will also cover personal information the firm has received from another financial institution.

SEC Commissioner Hester M. Peirce voiced concern that the new requirements may go too far.

“Today’s Regulation S-P modernization will help covered institutions appropriately prioritize safeguarding customer information,” she https://www.sec.gov/news/statement/peirce-statement-reg-s-p-051624 wrote. “Customers will be notified promptly when their information has been compromised so they can take steps to protect themselves, like changing passwords or keeping a closer eye on credit scores. My reservations stem from the breadth of the rule and the likelihood that it will spawn more consumer notices than are helpful.”

Regulation S-P hadn’t been substantially updated since its adoption in 2000.

Last year, the SEC adopted new regulations requiring publicly traded companies to disclose security breaches that materially affect or are reasonably likely to materially affect business, strategy, or financial results or conditions.

The amendments take effect 60 days after publication in the Federal Register, the official journal of the federal government that publishes regulations, notices, orders, and other documents. Larger organizations will have 18 months to comply after modifications are published. Smaller organizations will have 24 months.

Public comments on the amendments are available here.

https://arstechnica.com/?p=2025242

After launching Slack AI in February, Slack appears to be digging its heels in, defending its vague policy that by default sucks up customers’ data—including messages, content, and files—to train Slack’s global AI models.

According to Slack engineer Aaron Maurer, Slack has explained in a blog that the Salesforce-owned chat service does not train its large language models (LLMs) on customer data. But Slack’s policy may need updating “to explain more carefully how these privacy principles play with Slack AI,” Maurer wrote on Threads, partly because the policy “was originally written about the search/recommendation work we’ve been doing for years prior to Slack AI.”

Maurer was responding to a Threads post from engineer and writer Gergely Orosz, who called for companies to opt out of data sharing until the policy is clarified, not by a blog, but in the actual policy language.

“An ML engineer at Slack says they don’t use messages to train LLM models,” Orosz wrote. “My response is that the current terms allow them to do so. I’ll believe this is the policy when it’s in the policy. A blog post is not the privacy policy: every serious company knows this.”

The tension for users becomes clearer if you compare Slack’s privacy principles with how the company touts Slack AI.

Slack’s privacy principles specifically say that “Machine Learning (ML) and Artificial Intelligence (AI) are useful tools that we use in limited ways to enhance our product mission. To develop AI/ML models, our systems analyze Customer Data (e.g. messages, content, and files) submitted to Slack as well as other information (including usage information) as defined in our privacy policy and in your customer agreement.”

Meanwhile, Slack AI’s page says, “Work without worry. Your data is your data. We don’t use it to train Slack AI.”

Because of this incongruity, users called on Slack to update the privacy principles to make it clear how data is used for Slack AI or any future AI updates. According to a Salesforce spokesperson, the company has agreed an update is needed.

“Yesterday, some Slack community members asked for more clarity regarding our privacy principles,” Salesforce’s spokesperson told Ars. “We’ll be updating those principles today to better explain the relationship between customer data and generative AI in Slack.”

The spokesperson told Ars that the policy updates will clarify that Slack does not “develop LLMs or other generative models using customer data,” “use customer data to train third-party LLMs” or “build or train these models in such a way that they could learn, memorize, or be able to reproduce customer data.” The update will also clarify that “Slack AI uses off-the-shelf LLMs where the models don’t retain customer data,” ensuring that “customer data never leaves Slack’s trust boundary, and the providers of the LLM never have any access to the customer data.”

These changes, however, do not seem to address a key concern for users who never explicitly consented to sharing chats and other Slack content for use in AI training.

Users opting out of sharing chats with Slack

This controversial policy is not new. Wired warned about it in April, and TechCrunch reported that the policy has been in place since at least September 2023.

But widespread backlash began swelling last night on Hacker News, where Slack users called out the chat service for seemingly failing to notify users about the policy change, instead quietly opting them in by default. To critics, it felt like there was no benefit to opting in for anyone but Slack.

From there, the backlash spread to social media, where SlackHQ hastened to clarify Slack’s terms with explanations that did not seem to address all the criticism.

“I’m sorry Slack, you’re doing fucking WHAT with user DMs, messages, files, etc?” Corey Quinn, the chief cloud economist for a cost management company called Duckbill Group, posted on X. “I’m positive I’m not reading this correctly.”

SlackHQ responded to Quinn after the economist declared, “I hate this so much,” and confirmed that he had opted out of data sharing in his paid workspace.

“To clarify, Slack has platform-level machine-learning models for things like channel and emoji recommendations and search results,” SlackHQ posted. “And yes, customers can exclude their data from helping train those (non-generative) ML models. Customer data belongs to the customer.”

Later in the thread, SlackHQ noted, “Slack AI—which is our generative AI experience natively built in Slack—[and] is a separately purchased add-on that uses Large Language Models (LLMs) but does not train those LLMs on customer data.”

https://arstechnica.com/?p=2025179

Twitter.com links are now redirecting to the x.com domain as Elon Musk gets closer to wiping out the Twitter brand name over a year and half after buying the company.

“All core systems are now on X.com,” Musk wrote in an X post today. X also displayed a message to users that said, “We are letting you know that we are changing our URL, but your privacy and data protection settings remain the same.”

Musk bought Twitter in October 2022 and turned it into X Corp. in April 2023, but the social network continued to use Twitter.com as its primary domain for more than another year. X.com links redirected to Twitter.com during that time.

There were still remnants of Twitter after today’s change. This morning, I noticed a support link took me to a help.twitter.com page. The link subsequently redirected to a help.x.com page after I sent a message to X’s public relations email, though the timing could be coincidence. After sending that message to press@x.com, I got the standard auto-reply from press+noreply@twitter.com, just as I have in the past.

You might still encounter Twitter links that don’t redirect to x.com, depending on which browser you use. The Verge said it is “seeing a mix of results depending upon browser choice and whether you’re logged in or not.”

I had no trouble accessing x.com on desktop browsers today. But in Safari on iPhone, I received error messages when trying to access either twitter.com or x.com without first logging in. I eventually succeeded in logging in and was able to view content, but I remained at twitter.com in the iPhone browser instead of being redirected to x.com.

This will presumably be sorted out, but the awkward Twitter-to-X transition has previously been accompanied by technical problems. In early April, Musk’s service started automatically changing “twitter.com” to “x.com” in links posted by users in the iOS app. But the automatic text replacement initially applied to any URL ending in “twitter.com” even if it wasn’t actually a twitter.com link, which meant that phishers could have taken advantage by registering misleading domain names.

https://arstechnica.com/?p=2025138

In a lawsuit that seems determined to ignore that Section 230 exists, Robert F. Kennedy Jr. has sued Meta for allegedly shadowbanning his million-dollar documentary, Who Is Bobby Kennedy? and preventing his supporters from advocating for his presidential campaign.

According to Kennedy, Meta is colluding with the Biden administration to sway the 2024 presidential election by suppressing Kennedy’s documentary and making it harder to support Kennedy’s candidacy. This allegedly has caused “substantial donation losses,” while also violating the free speech rights of Kennedy, his supporters, and his film’s production company, AV24.

Meta had initially restricted the documentary on Facebook and Instagram but later fixed the issue after discovering that the film was mistakenly flagged by the platforms’ automated spam filters.

But Kennedy’s complaint claimed that Meta is still “brazenly censoring speech” by “continuing to throttle, de-boost, demote, and shadowban the film.” In an exhibit, Kennedy’s lawyers attached screenshots representing “hundreds” of Facebook and Instagram users whom Meta allegedly sent threats, intimidated, and sanctioned after they shared the documentary.

Some of these users remain suspended on Meta platforms, the complaint alleged. Others whose temporary suspensions have been lifted claimed that their posts are still being throttled, though, and Kennedy’s lawyers earnestly insisted that an exchange with Meta’s chatbot proves it.

Two days after the documentary’s release, Kennedy’s team apparently asked the Meta AI assistant, “When users post the link whoisbobbykennedy.com, can their followers see the post in their feeds?”

“I can tell you that the link is currently restricted by Meta,” the chatbot answered.

Chatbots, of course, are notoriously inaccurate sources of information, and Meta AI’s terms of service note this. In a section labeled “accuracy,” Meta warns that chatbot responses “may not reflect accurate, complete, or current information” and should always be verified.

Perhaps more significantly, there is little reason to think that Meta’s chatbot would have access to information about internal content moderation decisions.

Techdirt’s Mike Masnick mocked Kennedy’s reliance on the chatbot in the case. He noted that Kennedy seemed to have no evidence of the alleged shadow-banning, while there’s plenty of evidence that Meta’s spam filters accidentally remove non-violative content all the time.

Meta’s chatbot is “just a probabilistic stochastic parrot, repeating a probable sounding answer to users’ questions,” Masnick wrote. “And these idiots think it’s meaningful evidence. This is beyond embarrassing.”

Neither Meta nor Kennedy’s lawyer, Jed Rubenfeld, responded to Ars’ request to comment.

https://arstechnica.com/?p=2025044