Policy – Page 11

Colorado scrambles to change voting-system passwords after accidental leak

Biz & IT, colorado elections, Policy, voting system passwords / Mike M. / October 31, 2024

BIOS passwords on website

“The goal is to complete the password updates by this evening,” government says.

Colorado Secretary of State Jena Griswold holds press conference with Matt Crane, Executive Director of the Colorado County Clerks Association, at her office in Denver on Thursday, October 24, 2024. Credit: Getty Images | Hyoung Chang

The Colorado Department of State said it accidentally posted a spreadsheet containing “partial passwords” for voting systems. The department said there is no “immediate security threat” because two passwords are needed for each component, but it is trying to complete password changes by the end of today. There were reportedly hundreds of BIOS passwords accessible on the website for over two months before being removed last week.

A government statement issued Tuesday said the agency “is aware that a spreadsheet located on the Department’s website improperly included a hidden tab including partial passwords to certain components of Colorado voting systems. This does not pose an immediate security threat to Colorado’s elections, nor will it impact how ballots are counted.”

Secretary of State Jena Griswold told Colorado Public Radio that “we do not think there is an immediate security threat to Colorado elections, in part because partial passwords don’t get you anywhere. Two unique passwords are needed for every election equipment component. Physical access is needed. And under Colorado law, voting equipment is stored in secure rooms that require secure ID badges. There’s 24/7 video cameras. There’s restricted access to the secure ballot areas, strict chain of custody, and it’s a felony to access voting equipment without authorization.”

Griswold said her office learned about the spreadsheet upload at the end of last week and “immediately contacted federal partners and then we began our investigation.”

The department’s statement said the two passwords for each component “are kept in separate places and held by different parties” and that the “passwords can only be used with physical in-person access to a voting system.” Additionally, “clerks are required to maintain restricted access to secure ballot areas, and may only share access information with background-checked individuals. No person may be present in a secure area unless they are authorized to do so or are supervised by an authorized and background-checked employee.”

The department also cited “strict chain of custody requirements that track when a voting systems component has been accessed and by whom,” and it said that each “Colorado voter votes on a paper ballot, which is then audited during the Risk Limiting Audit to verify that ballots were counted according to voter intent.”

Goal is to change all passwords by this evening

Griswold described the upload as an accident and said the mistake was made by a civil servant who no longer works for the department. “Out of an abundance of caution, we have people in the field working to reset passwords and review access logs for affected counties,” she said.

Gov. Jared Polis and Griswold, who are both Democrats, issued a joint update about the password changes today. The Polis administration is providing support “to complete changes to all the impacted passwords and review logs to ensure that no tampering occurred.”

“The Secretary of State will deputize certain state employees, who have cybersecurity and technology expertise and have undergone appropriate background checks and training,” the statement said. “In addition to the Department of State Employees and in coordination with county clerks, these employees will only enter badged areas in pairs to update the passwords for election equipment in counties and will be directly observed by local elections officials from the county clerk’s office. The goal is to complete the password updates by this evening and verify the security of the voting components, which are secured behind locked doors by county clerks.”

Griswold said she is “thankful to the Governor for his support to quickly resolve this unfortunate mistake.” Griswold told Colorado Public Radio that her department has no reason to believe the passwords were posted with malicious intent, but said that “a personnel investigation will be conducted by an outside party to look into the particulars of how this occurred.”

GOP slams Griswold

The Colorado Republican Party criticized Griswold this week after receiving an affidavit from someone who said they accessed the BIOS passwords on the publicly available spreadsheet three times between August 8 and October 23. The file “contained over 600 BIOS passwords for voting system components in 63 of the state’s 64 counties” before being removed on October 24, the state GOP said.

The affidavit described how to reveal the passwords in the VotingSystemInventory.xlsx file. It said that right-clicking a worksheet tab and selecting “unhide” would reveal “a dialog box where the application user can select from one, several, or all four listed hidden worksheets contained in the file.” Three of these worksheets “appear to list Basic Input Output System (BIOS) passwords” for hundreds of individual voting system components, the affidavit said.

The state GOP accused Griswold of downplaying the security risk, saying that only one password is needed for BIOS access. “BIOS passwords are highly confidential, allowing broad access for knowledgeable users to fundamentally manipulate systems and data and to remove any trace of doing so,” the GOP said. The “passwords were not encrypted or otherwise protected,” the GOP said.

State GOP Chairman Dave Williams said the incident “represents significant incompetence and negligence, and it raises huge questions about password management and other basic security protocols at the highest levels within Griswold’s office.” He also claimed the breach could put “the entire Colorado election results for the vast majority of races, including the tabulation for the Presidential race in Colorado, in jeopardy unless all of the machines can meet the standards of a ‘Trusted Build’ before next Tuesday.”

US Rep. Lauren Boebert (R-Colo.) and other Republicans called on Griswold to resign. Griswold said she would stay on the job.

Griswold: “I’m going to keep doing my job”

Republicans in the state House “and Congresswoman Lauren Boebert are the same folks who have spread conspiracies and lies about our election systems over and over and over again,” Griswold told Colorado Public Radio. “Ultimately, a civil servant made a serious mistake and we’re actively working to address it.” Griswold added, “I have faced conspiracy theories from elected Republicans in this state, and I have not been stopped by any of their efforts and I’m going to keep on doing my job.”

Colorado previously had a voting-system breach orchestrated by former county clerk Tina Peters of Mesa County, who was sentenced to nine years in prison in early October. Peters, who promoted former President Donald Trump’s election conspiracy theories, oversaw a leak of voting-system BIOS passwords. Griswold said after the Peters conviction that “Tina Peters willfully compromised her own election equipment trying to prove Trump’s big lie.”

Testimony from the Peters case was cited in the GOP’s criticism of Griswold this week. “In the Tina Peters trial, a senior State official even testified that release of these passwords in a single county represented a grave threat. Here, they have been released for the whole state,” the state GOP said.

The Trump campaign called on Griswold to halt the processing of mail ballots and re-scan all mailed ballots that were already scanned.

Jon is a Senior IT Reporter for Ars Technica. He covers the telecom industry, Federal Communications Commission rulemakings, broadband consumer affairs, court cases, and government regulation of the tech industry.

Colorado scrambles to change voting-system passwords after accidental leak Read More »

Toxic X users sabotage Community Notes that could derail disinfo, report says

community notes, disinformation, elon musk, misinformation, Policy, Twitter, us election, X / Mike M. / October 31, 2024

It’s easy for biased users to bury accurate Community Notes, report says.

What’s the point of recruiting hundreds of thousands of X users to fact-check misleading posts before they go viral if those users’ accurate Community Notes are never displayed?

That’s the question the Center for Countering Digital Hate (CCDH) is asking after digging through a million notes in a public X dataset to find out how many misleading claims spreading widely on X about the US election weren’t quickly fact-checked.

In a report, the CCDH flagged 283 misleading X posts fueling election disinformation spread this year that never displayed a Community Note. Of these, 74 percent were found to have accurate notes proposed but ultimately never displayed—apparently due to toxic X users gaming Community Notes to hide information they politically disagree with.

On X, Community Notes are only displayed if a broad spectrum of X users with diverse viewpoints agree that the post is “helpful.” But the CCDH found that it’s seemingly easy to hide an accurate note that challenges a user’s bias by simply refusing to rate it or downranking it into oblivion.

“The problem is that for a Community Note to be shown, it requires consensus, and on polarizing issues, that consensus is rarely reached,” the CCDH’s report said. “As a result, Community Notes fail precisely where they are needed most.”

Among the most-viewed misleading claims where X failed to add accurate notes were posts spreading lies that “welfare offices in 49 states are handing out voter registration applications to illegal aliens,” the Democratic party is importing voters, most states don’t require ID to vote, and both electronic and mail-in voting are “too risky.”

These unchecked claims were viewed by tens of millions of users, the CCDH found.

One false narrative—that Dems import voters—was amplified in a post from Elon Musk that got 51 million views. In the background, proposed notes sought to correct the disinformation by noting that “lawful permanent residents (green card holders)” cannot vote in US elections until they’re granted citizenship after living in the US for five years. But even these seemingly straightforward citations to government resources did not pass muster for users politically motivated to hide the note.

This appears to be a common pattern on X, the CCDH suggested, and Musk is seemingly a multiplier. In July, the CCDH reported that Musk’s misleading posts about the 2024 election in particular were viewed more than a billion times without any notes ever added.

The majority of the misleading claims in the CCDH’s report seemed to come from conservative users. But X also failed to check a claim that Donald Trump “is no longer eligible to run for president and must drop out of the race immediately.” Posts spreading that false claim got 1.4 million views, the CCDH reported, and that content moderation misstep could potentially have risked negatively impacting Trump’s voter turnout at a time when Musk is campaigning for Trump.

Musk has claimed that while Community Notes will probably never be “perfect,” the fact-checking effort aspires to “be by far the best source of truth on Earth.” The CCDH has alleged that, actually, “most Community Notes are never seen by users, allowing misinformation to spread unchecked.”

Even X’s own numbers on notes seem low

On the Community Notes X account, X acknowledges that “speed is key to notes’ effectiveness—the faster they appear, the more people see them, and the greater effect they have.”

On the day before the CCDH report dropped, X announced that “lightning notes” have been introduced to deliver fact-checks in as little as 15 minutes after a misleading post is written.

“Ludicrously fast? Now reality!” X proclaimed.

Currently, more than 800,000 X users contribute to Community Notes, and with the lightning notes update, X can calculate their scores more quickly. That efficiency, X said, will either spike the amount of content removals or reduce sharing of false or misleading posts.

But while X insists Community Notes are working faster than ever to reduce harmful content spreading, the number of rapidly noted posts that X reports seems low. On a platform with an estimated 429 million daily active users worldwide, only about 400 notes were displayed within the past two weeks in less than an hour of a post going live. For notes that took longer—which the CCDH suggested is the majority if the fact-check is on a controversial topic—only about 60 more notes were displayed in more than an hour.

In July, an international NGO that monitors human rights abuses and corruption, Global Witness, found 45 “bot-like accounts that collectively produced around 610,000 posts” in a two-month period this summer on X, “amplifying racist and sexualized abuse, conspiracy theories, and climate disinformation” ahead of the UK general election.

Those accounts “posted prolifically during the UK general election,” then moved “to rapidly respond to emerging new topics amplifying divisive content,” including the US presidential race.

The CCDH reported that even when misleading posts get fact-checked, the original posts on average are viewed 13 times more than the note is seen, suggesting the majority of damage is done in the time before the note is posted.

Of course, content moderators are often called out for moving too slowly to remove harmful content, a Bloomberg opinion piece praising Community Notes earlier this year noted. That piece pointed to studies showing that “crowdsourcing worked just as well” as professional fact checkers “when assessing the accuracy of news stories,” concluding that “it may be impossible for any social media company to keep up, which is why it’s important to explore other approaches.”

X has said that it’s “common to see Community Notes appearing days faster than traditional fact checks,” while promising that more changes are coming to get notes ranked as “helpful” more quickly.

X risks becoming an echo chamber, data shows

Data that the market intelligence firm Sensor Tower recently shared with Ars offers a potential clue as to why the CCDH is seeing so many accurate notes that are never voted as “helpful.”

According to Sensor Tower’s estimates, global daily active users on X are down by 28 percent in September 2024, compared to October 2022 when Elon Musk took over Twitter. While many users have fled the platform, those who remained are seemingly more engaged than ever—with global engagement up by 8 percent in the same time period. (Rivals like TikTok and Facebook saw much lower growth, up by 3 and 1 percent, respectively.)

This paints a picture of X risking becoming an echo chamber, as loyal users engage more with the platform where misleading posts can seemingly easily go unchecked and buried notes potentially warp discussion in Musk’s “digital town square.”

When Musk initially bought Twitter, one of his earliest moves was to make drastic cuts to the trust and safety teams chiefly responsible for content-moderation decisions. He then expanded the role of Twitter’s Community Notes to substitute for trust and safety team efforts, where before Community Notes was viewed as merely complementary to broader monitoring.

The CCDH says that was a mistake and that the best way to ensure that X is safe for users is to build back X’s trust and safety teams.

“Our social media feeds have no neutral ‘town square’ for rational debate,” the CCDH report said. “In reality, it is messy, complicated, and opaque rules and systems make it impossible for all voices to be heard. Without checks and balances, proper oversight, and well-resourced trust and safety teams in place, X cannot rely on Community Notes to keep X safe.”

More transparency is needed on Community Notes

X and the CCDH have long clashed, with X unsuccessfully suing to seemingly silence the CCDH’s reporting on hate speech on X, which X claimed caused tens of millions in advertising losses. During that legal battle, the CCDH called Musk a “thin-skinned tyrant” who could not tolerate independent research on his platform. And a federal judge agreed that X was clearly suing to “punish” and censor the CCDH, dismissing X’s lawsuit last March.

Since then, the CCDH has resumed its reporting on X. In the most recent report, the CCDH urged that X needed to be more transparent about Community Notes, arguing that “researchers must be able to freely, without intimidation, study how disinformation and unchecked claims spread across platforms.”

The research group also recommended remedies, including continuing to advise that advertisers “evaluate whether their budgets are funding the misleading election claims identified in this report.”

That could lead brands to continue withholding spending on X, which is seemingly already happening. Sensor Tower estimated that “72 out of the top 100 spending US advertisers on X from October 2022 have ceased spending on the platform as of September 2024.” And compared to the first half of 2022, X’s ad revenue from the top 100 advertisers during the first half of 2024 was down 68 percent.

Most drastically, the CCDH recommended that US lawmakers reform Section 230 of the Communications Decency Act “to provide an avenue for accountability” by mandating risk assessments of social media platforms. That would “expose the risk posed by disinformation” and enable lawmakers to “prescribe possible mitigation measures including a comprehensive moderation strategy.”

Globally, the CCDH noted, some regulators have the power to investigate the claims in the CCDH’s report, including the European Commission under the Digital Services Act and the UK’s Ofcom under the Online Safety Act.

“X and social media companies as an industry have been able to avoid taking responsibility,” the CCDH’s report said, offering only “unreliable self-regulation.” Apps like X “thus invent inadequate systems like Community Notes because there is no legal mechanism to hold them accountable for their harms,” the CCDH’s report warned.

Perhaps Musk will be open to the CCDH’s suggestions. In the past, Musk has said that “suggestions for improving Community Notes are… always… much appreciated.”

Ashley is a senior policy reporter for Ars Technica, dedicated to tracking social impacts of emerging policies and new technologies. She is a Chicago-based journalist with 20 years of experience.

Toxic X users sabotage Community Notes that could derail disinfo, report says Read More »

Over 500 Amazon workers decry “non-data-driven” logic for 5-day RTO policy

Amazon, Policy, return-to-office, Tech / Paul Patrick / October 31, 2024

More than 500 Amazon workers reportedly signed a letter to Amazon Web Services’ (AWS) CEO this week, sharing their outrage over Amazon’s upcoming return-to-office (RTO) policy that will force workers into offices five days per week.

In September, Amazon announced that starting in 2025, workers will no longer be allowed to work remotely twice a week. At the time, Amazon CEO Andy Jassy said the move would make it easier for workers “to learn, model, practice, and strengthen our culture.”

Reuters reported today that it viewed a letter from a swath of workers sent to AWS chief Matt Garman on Wednesday regarding claims he reportedly made during an all-hands meeting this month. Garman reportedly told attendees that 9 out of 10 employees he spoke with support the five-day in-office work policy. The letter called the statements “inconsistent with the experiences of many employees” and “misrepresenting the realities of working at Amazon,” Reuters reported.

“We were appalled to hear the non-data-driven explanation you gave for Amazon imposing a five-day in-office mandate,’” the letter reportedly stated.

Employees banding together to protest against new, unfavorable work policies isn’t exclusive to Amazon. And the reported 500 workers who signed the letter represent just a fraction of Amazon’s worker base, which regulatory filings reported consisted of 1.5 million people in 2023. However, with the global conglomerate remaining firm about its stern policy thus far, eyes are on the Seattle firm’s HR approach, which could impact how other companies decide to implement RTO policies.

In the letter, hundreds of Amazon workers reportedly lamented what they believe was a lack of third-party data shared in making the RTO policy. It said that Garman’s statements “break the trust of your employees who have not only personal experience that shows the benefits of remote work but have seen the extensive data which supports that experience.”

Over 500 Amazon workers decry “non-data-driven” logic for 5-day RTO policy Read More »

Russia fines Google an impossible amount in attempt to end YouTube bans

Google, Policy, russia, youtube / Tim Belzer / October 31, 2024

Russia has fined Google an amount that no entity on the planet could pay in hopes of getting YouTube to lift bans on Russian channels, including pro-Kremlin and state-run news outlets.

The BBC wrote that a Russian court fined Google two undecillion rubles, which in dollar terms is $20,000,000,000,000,000,000,000,000,000,000,000. The amount “is far greater than the world’s total GDP, which is estimated by the International Monetary Fund to be $110 trillion.”

The fine is apparently that large because it was issued several years ago and has been repeatedly doubling. An RBC news report this week provided details on the court case from an anonymous source.

The Moscow Times writes, “According to RBC’s sources, Google began accumulating daily penalties of 100,000 rubles in 2020 after the pro-government media outlets Tsargrad and RIA FAN won lawsuits against the company for blocking their YouTube channels. Those daily penalties have doubled each week, leading to the current overall fine of around 2 undecillion rubles.”

The Moscow Times is an independent news organization that moved its operations to Amsterdam in 2022 in response to a Russian news censorship law. The news outlet said that 17 Russian TV channels filed legal claims against Google, including the state-run Channel One, the military-affiliated Zvezda broadcaster, and a company representing RT Editor-in-Chief Margarita Simonyan.

Kremlin rep: “I cannot even say this number”

Since Russia invaded Ukraine in 2022, Google has “blocked more than 1,000 YouTube channels, including state-sponsored news, and over 5.5 million videos,” Reuters wrote.

Russia fines Google an impossible amount in attempt to end YouTube bans Read More »

AT&T praises itself after getting caught taking too much money from FCC program

AT&T, Policy / Tim Belzer / October 30, 2024

AT&T improperly obtained money from a government-run broadband discount program by submitting duplicate requests and by claiming subsidies for thousands of subscribers who weren’t using AT&T’s service. AT&T obtained funding based on false certifications it made under penalty of perjury.

AT&T on Friday agreed to pay $2.3 million in a consent decree with the Federal Communications Commission’s Enforcement Bureau. That includes a civil penalty of $1,921,068 and a repayment of $378,922 to the US Treasury.

The settlement fully resolves the FCC investigation into AT&T’s apparent violations, the consent decree said. “AT&T admits for the purpose of this Consent Decree and for Commission civil enforcement purposes” that the findings described by the FCC “contain a true and accurate description of the facts underlying the Investigation,” the document said.

In addition to the civil penalty and repayment, AT&T agreed to a compliance plan designed to prevent further violations. AT&T last week reported quarterly revenue of $30.2 billion.

AT&T made the excessive reimbursement claims to the Emergency Broadband Benefit Program (EBB), which the US formed in response to the COVID-19 pandemic, and to the EBB’s successor program, the Affordable Connectivity Program (ACP). The FCC said its rules “are vital to protecting these Programs and their resources from waste, fraud, and abuse.”

AT&T praises itself for using federal program

We contacted AT&T today and asked for an explanation of what caused the violations. Instead, AT&T provided Ars with a statement that praised itself for participating in the federal discount programs.

“When the federal government acted during the COVID-19 pandemic to stand up the Emergency Broadband Benefit program, and then the Affordable Connectivity Program, we quickly implemented both programs to provide more low-cost Internet options for our customers. We take compliance with federal programs like these seriously and appreciate the collaboration with the FCC to reach a solution on this matter,” AT&T said.

The EBB provided monthly subsidies of $50 for eligible households, while the ACP offered $30 a month. Telecoms provided the discounts to subscribers directly and sought reimbursement from the programs. The ACP ended a few months ago after Congress did not provide additional funding.

AT&T praises itself after getting caught taking too much money from FCC program Read More »

TSA silent on CrowdStrike’s claim Delta skipped required security update

Crowdstrike, crowdstrike falcon, Cybersecurity, Delta, DOT, global it outage, it outage, microsoft, Policy, TSA / Rejus Almole / October 29, 2024

We’re all trying to find the guy who did this

CrowdStrike and Delta’s legal battle has begun. Will Microsoft be sued next?

Travelers sit with their luggage on the check-in floor of the Delta Air Lines terminal at Los Angeles International Airport (LAX) on July 23, 2024 in Los Angeles, California. Credit: Mario Tama / Staff | Getty Images News

Delta and CrowdStrike have locked legal horns, threatening to drag out the aftermath of the worst IT outage in history for months or possibly years.

Each refuses to be blamed for Delta’s substantial losses following a global IT outage caused by CrowdStrike suddenly pushing a flawed security update despite Delta and many other customers turning off auto-updates.

CrowdStrike has since given customers more control over updates and made other commitments to ensure an outage of that scale will never happen again, but Delta isn’t satisfied. The airline has accused CrowdStrike of willfully causing losses by knowingly deceiving customers by failing to disclose an unauthorized door into their operating systems that enabled the outage.

In a court filing last Friday, Delta alleged that CrowdStrike should be on the hook for the airline’s more than $500 million in losses—partly because CrowdStrike has admitted that it should have done more testing and staggered deployments to catch the bug before a wide-scale rollout that disrupted businesses worldwide.

“As a result of CrowdStrike’s failure to use a staged deployment and without rollback capabilities, the Faulty Update caused widespread and catastrophic damage to millions of computers, including Delta’s systems, crashing Delta’s workstations, servers, and redundancy systems,” Delta’s complaint said.

Delta has further alleged that CrowdStrike postured as a certified best-in-class security provider who “never cuts corners” while secretly designing its software to bypass Microsoft security certifications in order to make changes at the core of Delta’s computing systems without Delta’s knowledge.

“Delta would have never agreed to such a dangerous process had CrowdStrike disclosed it,” Delta’s complaint said.

In testimony to Congress, CrowdStrike executive Adam Meyers suggested that the faulty update did follow standard protocols. He explained that “CrowdStrike’s software code is certified by Microsoft” and that it’s “updated less frequently,” and “new configurations are sent with rapid occurrence to protect against threats as they evolve,” not to bypass security checks, as Delta alleged.

But by misleading customers about these security practices, Delta alleged, CrowdStrike put “profit ahead of protection and software stability.” As Delta sees it, CrowdStrike built in the unauthorized door so that it could claim to resolve security issues more quickly than competitors. And if a court agrees that CrowdStrike’s alleged failure to follow standard industry best practices does constitute, at the very least, “gross negligence,” Delta could win.

“While we aimed to reach a business resolution that puts customers first, Delta has chosen a different path,” CrowdStrike’s spokesperson told Ars. “Delta’s claims are based on disproven misinformation, demonstrate a lack of understanding of how modern cybersecurity works, and reflect a desperate attempt to shift blame for its slow recovery away from its failure to modernize its antiquated IT infrastructure. We have filed for a declaratory judgment to make it clear that CrowdStrike did not cause the harm that Delta claims and they repeatedly refused assistance from both CrowdStrike and Microsoft. Any claims of gross negligence and willful misconduct have no basis in fact.”

CrowdStrike sues to expose Delta’s IT flaws

In its court filing, however, CrowdStrike said there’s much more to the story than that. It has accused Delta of failing to follow laws, including best practices established by the Transportation Security Administration (TSA).

While many CrowdStrike customers got systems back up and running within a day of the outage, Delta’s issues stretched painfully for five days, disrupting travel for a million customers. According to CrowdStrike, the prolonged delay at Delta was not due to CrowdStrike failing to provide adequate assistance but allegedly to Delta’s own negligence to comply with TSA requirements designed to ensure that no major airline ever experiences prolonged system outages.

“Despite the immediate response from CrowdStrike, it was Delta’s own response and IT infrastructure that caused delays in Delta’s ability to resume normal operation, resulting in a longer recovery period than other major airlines,” CrowdStrike’s complaint said.

In March 2023, the TSA added a cybersecurity emergency amendment to its cybersecurity programs. The amendment required airlines like Delta to develop “policies and controls to ensure that operational technology systems can continue to safely operate in the event that an information technology system has been compromised,” CrowdStrike’s complaint said.

Complying with the amendment ensured that airlines could “timely” respond to any exploitation of their cybersecurity or operating systems, CrowdStrike explained.

CrowdStrike realized that Delta was allegedly non-compliant with the TSA requirement and other laws when its “efforts to help remediate the issues revealed” alleged “technological shortcomings and failures to follow security best practices, including outdated IT systems, issues in Delta’s active directory environment, and thousands of compromised passwords.”

TSA declined Ars’ request to comment on whether it has any checks in place to ensure compliance with the emergency amendment.

While TSA has made no indication so far that it intends to investigate CrowdStrike’s claims, the Department of Transportation (DOT) is currently investigating Delta’s seemingly inferior customer service during the outage. That probe could lead to monetary fines, potentially further expanding Delta’s losses.

In a statement, DOT Secretary Pete Buttigieg said, “We have made clear to Delta that they must take care of their passengers and honor their customer service commitments. This is not just the right thing to do, it’s the law, and our department will leverage the full extent of our investigative and enforcement power to ensure the rights of Delta’s passengers are upheld.”

On X (formerly Twitter), Buttigieg said that the probe was sparked after DOT received hundreds of complaints about Delta’s response. A few days later, Buttigieg confirmed that the probe would “ensure the airline is following the law and taking care of its passengers during continued widespread disruptions.” But DOT declined Ars’ request to comment on whether DOT was investigating Delta’s alleged non-compliance with TSA security requirements, only noting that “TSA is not part of DOT.”

Will Microsoft be sued next?

Delta has been threatening legal action over the CrowdStrike outage since August, when Delta confirmed in an SEC filing that the outage caused “approximately 7,000 flight cancellations over five days.” At that time, Delta CEO Ed Bastian announced, “We are pursuing legal claims against CrowdStrike and Microsoft to recover damages caused by the outage, which total at least $500 million.”

But Delta’s lawsuit Friday notably does not name Microsoft as a defendant.

Ars could not immediately reach Delta’s lawyer, David Boies, to confirm if another lawsuit may be coming or if that legal threat to Microsoft was dropped.

It could be that Microsoft dissuaded Delta from filing a complaint. Immediately in August, Microsoft bucked Delta’s claims that the tech giant was in any way liable for Delta’s losses, The Register reported. In a letter to Boies, Microsoft lawyer Mark Cheffo wrote that Microsoft “empathizes” with Delta, but Delta’s public comments blaming Microsoft for the outage are “incomplete, false, misleading, and damaging to Microsoft and its reputation.”

“The truth is very different from the false picture you and Delta have sought to paint,” Cheffo wrote, noting that Microsoft did not cause the outage and Delta repeatedly turned down Microsoft’s offers to help restore its systems. That includes one instance where a Delta employee allegedly responded to a Microsoft inquiry three days after the outage by saying that Delta was “all good.” Additionally, a message from Microsoft CEO Satya Nadella to Delta’s Bastian allegedly went unanswered.

Cheffo alleged that Delta was cagey about accepting Microsoft’s help because “the IT system it was most having trouble restoring—its crew-tracking and scheduling system—was being serviced by other technology providers, such as IBM, because it runs on those providers’ systems, and not Microsoft Windows or Azure.”

According to Cheffo, Microsoft was “surprised” when Delta threatened to sue since the issues seemed to be with Delta’s IT infrastructure, not Microsoft’s services.

“Microsoft continues to investigate the circumstances surrounding the CrowdStrike incident to understand why other airlines were able to fully restore business operations so much faster than Delta, including American Airlines and United Airlines,” Cheffo wrote. “Our preliminary review suggests that Delta, unlike its competitors, apparently has not modernized its IT infrastructure, either for the benefit of its customers or for its pilots and flight attendants.”

At that time, Cheffo told Boies that Microsoft planned to “vigorously defend” against any litigation. Additionally, Microsoft’s lawyer demanded that Delta preserve documents, including ones showing “the extent to which non-Microsoft systems or software, including systems provided and/or designed by IBM, Oracle, Amazon Web Services, Kyndryl or others, and systems using other operating systems, such as Linux, contributed to the interruption of Delta’s business operations between July 19 and July 24.”

It seems possible that Cheffo’s letter spooked Delta out of naming Microsoft as a defendant in the lawsuit over the outage, potentially to avoid a well-resourced opponent or to save public face if Microsoft’s proposed discovery threatened to further expose Delta’s allegedly flawed IT infrastructure.

Microsoft declined Ars’ request to comment.

CrowdStrike says TOS severely limits damages

CrowdStrike appears to be echoing Microsoft’s defense tactics, arguing that Delta struggled to recover due to its own IT failures.

According to CrowdStrike, even if Delta’s breach of contract claims are valid, CrowdStrike’s terms of service severely limit damages. At most, CrowdStrike’s terms stipulate, damages owed to Delta may be “two times the value of the fees paid to service provider for the relevant subscription services subscription term,” which is likely substantially less than $500 million.

And Delta wants much more than lost revenue returned. Beyond the $500 million in losses, the airline has asked a Georgia court to calculate punitive damages and recoup Delta for future revenue losses as its reputation took a hit due to public backlash from Delta’s lackluster response to the outage.

“CrowdStrike must ‘own’ the disaster it created,” Delta’s complaint said, alleging that “CrowdStrike failed to exercise the slight diligence or care of the degree that persons of common sense, however inattentive they may be, would use under the same or similar circumstances.”

CrowdStrike is hoping a US district court jury will agree that Delta was the one that dropped the ball the most as the world scrambled to recover from the outage. The cybersecurity company has asked the jury to declare that any potential damages are limited by CrowdStrike’s subscriber terms and that “CrowdStrike was not grossly negligent and did not commit willful misconduct in any way.”

This story was updated to include CrowdStrike’s statement.

Ashley is a senior policy reporter for Ars Technica, dedicated to tracking social impacts of emerging policies and new technologies. She is a Chicago-based journalist with 20 years of experience.

TSA silent on CrowdStrike’s claim Delta skipped required security update Read More »

Google accused of shadow campaigns redirecting antitrust scrutiny to Microsoft

Antitrust law, cispe, Cloud Computing, cloud services, European Union, Google, microsoft, open cloud coalition, Policy, united kingdom / Rejus Almole / October 28, 2024

On Monday, Microsoft came out guns blazing, posting a blog accusing Google of “dishonestly” funding groups conducting allegedly biased studies to discredit Microsoft and mislead antitrust enforcers and the public.

In the blog, Microsoft lawyer Rima Alaily alleged that an astroturf group called the Open Cloud Coalition will launch this week and will appear to be led by “a handful of European cloud providers.” In actuality, however, those smaller companies were secretly recruited by Google, which allegedly pays them “to serve as the public face” and “obfuscate” Google’s involvement, Microsoft’s blog said. In return, Google likely offered the cloud providers cash or discounts to join, Alaily alleged.

The Open Cloud Coalition is just one part of a “pattern of shadowy campaigns” that Google has funded, both “directly and indirectly,” to muddy the antitrust waters, Alaily alleged. The only other named example that Alaily gives while documenting this supposed pattern is the US-based Coalition for Fair Software Licensing (CFSL), which Alaily said has attacked Microsoft’s cloud computing business in the US, the United Kingdom, and the European Union.

That group is led by Ryan Triplette, who Alaily said is “a well-known lobbyist for Google in Washington, DC, but Google’s affiliation isn’t disclosed publicly by the organization.” An online search confirms Triplette was formerly a lobbyist for Franklin Square Group, which Politico reported represented Google during her time there.

Ars could not immediately reach the CFSL for comment. Google’s spokesperson told Ars that the company has “been a public supporter of CFSL for more than two years” and has “no idea what evidence Microsoft cites that we are the main funder of CFSL.” If Triplette was previously a lobbyist for Google, the spokesperson said, “that’s a weird criticism to make” since it’s likely “everybody in law, policy, etc.,” has “worked for Google, Microsoft, or Amazon at some point, in some capacity.”

Google accused of shadow campaigns redirecting antitrust scrutiny to Microsoft Read More »

Don’t fall for AI scams cloning cops’ voices, police warn

ai voice cloning, ai voice scams, Artificial Intelligence, generative ai, Policy / Tim Belzer / October 28, 2024

AI is giving scammers a more convincing way to impersonate police, reports show.

Just last week, the Salt Lake City Police Department (SLCPD) warned of an email scam using AI to convincingly clone the voice of Police Chief Mike Brown.

A citizen tipped off cops after receiving a suspicious email that included a video showing the police chief claiming that they “owed the federal government nearly $100,000.”

To dupe their targets, the scammers cut together real footage from one of Brown’s prior TV interviews with AI-generated audio that SLCPD said “is clear and closely impersonates the voice of Chief Brown, which could lead community members to believe the message was legitimate.”

The FBI has warned for years of scammers attempting extortion by impersonating cops or government officials. But as AI voice-cloning technology has advanced, these scams could become much harder to detect, to the point where even the most forward-thinking companies like OpenAI have been hesitant to release the latest tech due to obvious concerns about potential abuse.

SLCPD noted that there were clues in the email impersonating their police chief that a tech-savvy citizen could have picked up on. A more careful listen reveals “the message had unnatural speech patterns, odd emphasis on certain words, and an inconsistent tone,” as well as “detectable acoustic edits from one sentence to the next.” And perhaps most glaringly, the scam email came from “a Google account and had the Salt Lake City Police Department’s name in it followed by a numeric number,” instead of from the police department’s official email domain of “slc.gov.”

SLCPD isn’t the only police department dealing with AI cop impersonators. Tulsa had a similar problem this summer when scammers started calling residents using a convincing fake voice designed to sound like Tulsa police officer Eric Spradlin, Public Radio Tulsa reported. A software developer who received the call, Myles David, said he understood the AI risks today but that even he was “caught off guard” and had to call police to verify the call wasn’t real.

Don’t fall for AI scams cloning cops’ voices, police warn Read More »

Are Boeing’s problems beyond fixable?

aviation, Boeing, Boeing 737 MAX, Policy, syndication / Tim Belzer / October 26, 2024

A new CEO promises a culture change as the aerospace titan is struggling hard.

Credit: Getty Images | Olivier Douliery

As Boeing’s latest chief executive, Kelly Ortberg’s job was never going to be easy. On Wednesday, it got harder still.

That morning, Ortberg had faced investors for the first time, telling them that ending a debilitating strike by Boeing’s largest union was the first step to stabilizing the plane maker’s business.

But as the day wore on, it became clear that nearly two-thirds of the union members who voted on the company’s latest contract offer had rejected it. The six-week strike goes on, costing Boeing an estimated $50 million a day, pushing back the day it can resume production of most aircraft and further stressing its supply chain.

The company that virtually created modern commercial aviation has spent the better part of five years in chaos, stemming from fatal crashes, a worldwide grounding, a guilty plea to a criminal charge, a pandemic that halted global air travel, a piece breaking off a plane in mid-flight and now a strike. Boeing’s finances look increasingly fragile and its reputation has been battered.

Bank of America analyst Ron Epstein says Boeing is a titan in a crisis largely of its own making, comparing it to the Hydra of Greek mythology: “For every problem that’s come to a head, then [been] severed, more problems sprout up.”

Resolving Boeing’s crisis is critical to the future of commercial air travel, as most commercial passenger aircraft are made by it or its European rival Airbus, which has little capacity for new customers until the 2030s.

Ortberg, a 64-year-old Midwesterner who took the top job three months ago, says his mission is “pretty straightforward—turn this big ship in the right direction and restore Boeing to the leadership position that we all know and want.”

Resolving the machinists’ strike is just the start of the challenges he faces. He needs to motivate the workforce, even as 33,000 are on strike and 17,000 face redundancy under a cost-cutting initiative.

He must persuade investors to support an equity raise in an industry where the returns could take years to materialize. He needs to fix Boeing’s quality control and manufacturing issues, and placate its increasingly frustrated customers, who have had to rejig their schedules and cut flights owing to delays in plane deliveries.

“I’ve never seen anything like it in our industry, to be honest. I’ve been around 30 years,” Carsten Spohr, chief executive of German flag carrier Lufthansa, said this month.

Eventually, Boeing needs to launch a new aircraft model to better compete with Airbus.

“If Kelly fixes this, he is a hero,” says Melius Research analyst Rob Spingarn. “But it’s very complex. There’s a lot of different things to fix.”

Ortberg started his career as a mechanical engineer and went on to run Rockwell Collins, an avionics supplier to Boeing, until it was sold to engineering conglomerate United Technologies in 2018.

His engineering background has been welcomed by many who regard previous executives’ emphasis on shareholder returns as the root cause of many of Boeing’s engineering and manufacturing problems.

Longtime employees often peg the shift in Boeing’s culture to its 1997 merger with rival McDonnell Douglas. Phil Condit and Harry Stonecipher, who ran Boeing in the late 1990s and early 2000s, were admirers of Jack Welch, the General Electric chief executive known for financial engineering and ruthless cost cuts.

Condit even moved Boeing’s headquarters from its manufacturing base in Seattle to Chicago in 2001, so the “corporate center” would no longer be “drawn into day-to-day business operations.”

Jim McNerney, another Welch acolyte, instituted a program to boost Boeing’s profits by squeezing its suppliers during his decade in charge. He remarked on a 2014 earnings call about employees “cowering” before him, a dark quip still cited a decade later to explain Boeing’s tense relationship with its workers.

Ken Ogren, a member of the International Association of Machinists and Aerospace Workers District 751, says managers at Boeing often felt pressured to move planes quickly through the factory.

“We’ve had a lot of bean counters come through, and I’m going to be in the majority with a lot of people who believe they’ve been tripping over dollars to save pennies,” he says.

Dennis Muilenburg headed the company in October 2018, when a new 737 Max crashed off the coast of Indonesia. Five months later, another Max crashed shortly after take-off in Ethiopia. In total, 346 people lost their lives.

Regulators worldwide grounded the plane—a cash cow and a vital product in Boeing’s competition with Airbus—for nearly two years. Investigations eventually showed a faulty sensor triggered an anti-stall system, repeatedly forcing the aircraft’s nose downward.

Boeing agreed in July to plead guilty to a criminal charge of fraud for misleading regulators about the plane’s design. Families of the crash victims are opposing the plea deal, which is before a federal judge for approval.

The manufacturer’s problems were compounded by COVID-19, which grounded aircraft worldwide and led many airlines to hold off placing new orders and pause deliveries of existing ones. Boeing’s debt ballooned as it issued $25 billion in bonds to see it through the crisis.

Regulators cleared the 737 Max to fly again, starting in November 2020. But hopes that Boeing was finally on top of its problems were shattered last January, when a door panel that was missing bolts blew off an Alaska Airlines jet at 16,000 feet.

While no one was injured, the incident triggered multiple investigations and an audit by the US Federal Aviation Administration, which found lapses in Boeing’s manufacturing and quality assurance processes and led to an uncomfortable appearance by then chief executive Dave Calhoun at a Senate subcommittee hearing.

The company also has struggled with its defense and space businesses. Fixed-price contracts on several military programs have resulted in losses and billions of dollars of one-off charges. Meanwhile, problems with its CST-100 Starliner spacecraft resulted in two astronauts being left on the International Space Station. SpaceX’s Crew Dragon vehicle will be used to return them to Earth early next year.

Boeing’s stumbles have resulted in loss of life, loss of prestige, and a net financial loss every year since 2019. On Wednesday, it reported a $6 billion loss between July and September, the second-worst quarterly result in its history.

One of Ortberg’s first big moves as chief executive was to move himself—from his Florida home to a house in Seattle. He told analysts that Boeing’s executives “need to be on the factory floors, in the back shops, and in our engineering labs” to be more in tune with the company’s products and workforce. Change in Boeing’s corporate culture must “be more than the poster on the wall,” he added.

His approach represents a shift from his predecessor Calhoun, who was criticized for spending more time in New Hampshire and South Carolina than in Boeing’s factories in Washington state.

Bill George, former chief executive at Medtronic and an executive fellow at Harvard Business School, says Ortberg is doing a “terrific job” so far, particularly for moving to the Pacific Northwest and pressuring other itinerant executives to follow.

“If you’re based in Florida, and you come occasionally, what do you really know about what’s going on in the business?” he says, adding that Boeing has “no business being in Arlington, Virginia,” where the company moved its headquarters in 2022.

Scott Kirby, chief executive at one of Boeing’s biggest customers, United Airlines, told his own investors this month that he was “encouraged” by Ortberg’s early moves, adding that the company suffered for decades from “a cultural challenge, where they focused on short-term profitability and the short-term stock price at the expense of what made Boeing great, which is building great products.”

“Kelly Ortberg is pivoting the company back to their roots,” he said. “All the employees of Boeing will rally around that.”

But Ogren of the machinists’ union cautions that previous commitments to culture change have been hollow. “You’ve got people at the top saying, ‘We’ve got to be safe, oh, and by the way, we need these planes out the door…’ They said the right thing. They didn’t emphasize it, and that’s not what they put pressure on the managers to achieve.”

When workers eventually return to work—Peter Arment, an analyst at Baird, expects the dispute to be resolved in November—Ortberg wants better execution, even if it means lower output. “It is so much more important we do this right than fast,” he said.

The company had planned to raise Max output from about 25 per month before the strike to 38 per month by the end of the year, a cap set by the FAA. It will not reach that goal and Spingarn, the Melius analyst, says the strike will probably delay any production increase by nine months to a year. Some workers would need retraining, Ortberg said, and the supply chain’s restart was likely to be “bumpy.” The manufacturer also has established a quality plan with the FAA that it must follow.

Boeing also needed to launch a new airplane “at the right time in the future,” Ortberg said. Epstein of BofA called this “one of the most important messages” from the new chief executive, likely “to reinvigorate the workforce and culture at Boeing.”

In the meantime, Boeing will continue to consume cash in 2025, having burnt through $10 billion so far this year, according to chief financial officer Brian West. Spingarn says that investors may be disappointed in the cash flow at first, but adds that “fixing airplanes isn’t one year, it’s three years.”

For all the challenges, Ortberg has the right personality to turn Boeing around, says Ken Herbert, an analyst at RBC Capital Markets.

“If he can’t do it, I don’t think anyone can.”

Are Boeing’s problems beyond fixable? Read More »

US Copyright Office “frees the McFlurry,” allowing repair of ice cream machines

mcflurry, Policy, soft serve ice cream machines / Kris Guyer / October 25, 2024

Manufacturers opposed the exemption, but it received support from the Department of Justice Antitrust Division, the Federal Trade Commission, and the National Telecommunications and Information Administration.

“The Register recommends adopting a new exemption covering diagnosis, maintenance, and repair of retail-level commercial food preparation equipment because proponents sufficiently showed, by a preponderance of the evidence, adverse effects on the proposed noninfringing uses of such equipment,” the Register’s findings said.

The exemption does not include commercial and industrial food preparation devices. Unlike the retail-level equipment, the software-enabled industrial machines “may be very different in multiple aspects and proponents have not established a record of adverse effects with respect to industrial equipment,” the Register wrote.

Error codes unintuitive and often change

While ice cream machines aren’t the only devices affected, the Register’s recommendations note that “proponents primarily relied on an example of a frequently broken soft-serve ice cream machine used in a restaurant to illustrate the adverse effects on repair activities.”

Proponents said that fixing the Taylor Company ice cream machines used at McDonald’s required users to interpret “unintuitive” error codes. Some error codes are listed in the user manual, but these manuals were said to be “often outdated and incomplete” because error codes could change with each firmware update.

Difficulties in repair related to “technological protection measures,” or TPMs, were described as follows:

Moreover, other error codes can only be accessed by reading a service manual that is made available only to authorized technicians or through a “TPM-locked on-device service menu.” This service menu can only be accessed by using a manufacturer-approved diagnostic tool or through an “extended, undocumented combination of key presses.” However, “it is unclear whether the 16-press key sequence… still works, or has been changed in subsequent firmware updates.” Proponents accordingly asserted that many users are unable to diagnose and repair the machine without circumventing the machine’s TPM to access the service menu software, resulting in significant financial harm from lost revenue.

The Register said it’s clear that “diagnosis of the soft-serve machine’s error codes for purposes of repair can often only be done by accessing software on the machine that is protected by TPMs (which require a passcode or proprietary diagnostic tool to unlock),” and that “the threat of litigation from circumventing them inhibits users from engaging in repair-related activities.”

US Copyright Office “frees the McFlurry,” allowing repair of ice cream machines Read More »

Video game libraries lose legal appeal to emulate physical game collections online

gaming, Policy / Kris Guyer / October 25, 2024

In an odd footnote, the Register also notes that emulation of classic game consoles, while not infringing in its own right, has been “historically associated with piracy,” thus “rais[ing] a potential concern” for any emulated remote access to library game catalogs. That footnote paradoxically cites Video Game History Foundation (VGHF) founder and director Frank Cifaldi’s 2016 Game Developers Conference talk on the demonization of emulation and its importance to video game preservation.

“The moment I became the Joker is when someone in charge of copyright law watched my GDC talk about how it’s wrong to associate emulation with piracy and their takeaway was ’emulation is associated with piracy,'” Cifaldi quipped in a social media post.

The fight continues

In a statement issued in response to the decision, the VGHF called out “lobbying efforts by rightsholder groups” that “continue to hold back progress” for researchers. The status quo limiting remote access “forces researchers to explore extra-legal methods to access the vast majority of out-of-print video games that are otherwise unavailable,” the VGHF writes.

“Frankly my colleagues in literary studies or film history have pretty routine and regular access to digitized versions of the things they study,” NYU professor Laine Nooney argued to the Copyright Office earlier this year. “These [travel] impediments [to access physical games] are real and significant and they do impede research in ways that are not equitable compared to our colleagues in other disciplines.”

Software archives like the one at the University of Michigan can be a great resource… if you’re on the premises, that is. Credit: University of Michigan

Speaking to Ars Technica, VGHF Library Director Phil Salvador said that the group was “disappointed” in the Copyright Office decision but “proud of the work we’ve done and the impact this process has had. The research we produced during this process has already helped justify everything from game re-releases to grants for researching video game history. Our fight this cycle has raised the level of discourse around game preservation, and we’re going to keep that conversation moving within the game industry.”

Video game libraries lose legal appeal to emulate physical game collections online Read More »

X Payments delayed after Musk’s X weirdly withdrew application for NY license

consumer financial protection bureau, elon musk, fintech, Policy, Twitter, X, x corp, x payments / Tim Belzer / October 25, 2024

Will X Payments launch this year? Outlook not so good.

Credit: Aurich Lawson | Getty Images/Bloomberg

This October, many Elon Musk believers are wondering, where is X Payments?

Last year, Musk claimed in a Spaces conversation that he “would be surprised” if it took longer than mid-2024 to roll out the payments feature that he believes is crucial to transforming the social media app formerly known as Twitter into an everything app.

“It would blow my mind if we don’t have that rolled out by the end of next year,” Musk said around this time last year, clarifying that “when I say payments, I actually mean someone’s entire financial life. If it involves money, it’ll be on our platform. Money or securities or whatever. So, it’s not just like ‘send $20 to my friend.’ I’m talking about, like, you won’t need a bank account.”

Echoing Musk as recently as June, X CEO Linda Yaccarino was hyping the US release of X Payments as imminent. But it has been months without another peep from X leadership, and Ars recently confirmed that X took a curious step in April that suggests the payments feature may be delayed indefinitely.

During the Spaces conversation last December with Ark Invest CEO Cathie Wood, Musk discussed X’s bid to secure money transmitter licenses in all 50 states, noting that it would be “irrelevant” to launch X Payments without California and New York licenses.

Since then, X has made a decent amount of progress, picking up money transmitter licenses in 38 states, including a critical license in California.

But approvals in New York were reportedly stalled for months after a New York City law firm, now called Walden Macht Haran & Williams (WMHW), sent an open letter to attorneys general and banking commissioners in all 50 states in September 2023, urging that X be deemed “unfit” for a money transmitter license.

WMHW had filed a lawsuit alleging that Twitter—before Musk acquired it—”acted at the direction of the Kingdom of Saudi Arabia (KSA) in furtherance of KSA’s long-running campaign of transnational repression.”

That campaign led to the murder of Washington Post correspondent Jamal Khashoggi and the “imprisonment of Abdulrahman Al-Sadhan, a human rights worker and anonymous Twitter user, whose confidential user data—leaked by Twitter’s employees—precipitated and enabled this barbarity,” the letter alleged. And when Musk took over the platform, he only deepened the app’s KSA ties further when he “invited KSA to convert its shares in Twitter into a financial stake during his private take-over of the platform,” the letter said.

Rather than grant X money transmitter licenses, WMHW recommended that attorneys general and banking commissioners use X’s money transmitter licenses as an excuse to investigate the allegations and demystify the app’s allegedly dangerous KSA ties.

Apparently, X either did not like the heat or decided to rethink its X Payments strategy, because the New York Department of Financial Services provided new information to Ars this week confirming that X withdrew its money transmitter license in New York in April 2024.

The department also confirmed that X has not since resubmitted the application.

However, WMHW this month voluntarily dismissed its client’s lawsuit against X and declined to comment on whether the open letter seemingly worked to block X Payments’ launch. It seems possible that X may leverage that court win to eventually resubmit its application for a New York license, but Ars could not confirm if X has any plans to resubmit any time soon.

An X spokesperson answered Ars’ request to comment (which rarely happens) but declined to provide an update on any new timeline for X Payments’ launch.

X Payments unlikely to launch without New York

It seems possible that X has gone silent on X Payments because there is no timeline currently.

A global payments expert for tech consultancy Capco, Daniela Hawkins, told Ars that, as an outsider going just off a “gut check,” if X has withdrawn its application from New York—with “New York obviously being such a major metropolitan area… that would seem to be a barrier to entry into the payments market.”

X could launch X Payments without New York and other states, but Hawkins said users might be confused about where they can and cannot send money. Hawkins thinks it’s unlikely that Musk—who co-founded PayPal and has wanted to launch his own payments app since—would roll out X Payments “half-assed.”

Basically, if X pushed through with the launch, users could accept and send funds just like they can using any other payments app, but without licenses in all states, X users could only send money to people located in states where X has licenses. Hawkins said that inconsistency could deter popular use of the payments feature because “it’s too difficult for the consumer to understand.”

“If you roll it out with handcuffs on it, it’s gonna have a bumpy launch,” Hawkins said. “So why would you do that?”

Going that route, X seemingly risks users ditching X to complete payments on apps where every transaction reliably goes through, Hawkins suggested.

“They’re gonna be like, ‘Wait, I don’t know where this Etsy shop is located, I don’t care,” Hawkins said, noting, “that’s just a bad user experience.”

More regulations on payment apps coming

Last year, Hawkins told Ars that X faced an “uphill battle” launching X Payments, partly due to intensifying regulations on the financial services industry that are increasingly pulling payments apps into regulations typically focused on regulating traditional banking services.

Just days ago, the Consumer Financial Protection Bureau (CFPB) issued a final rule requiring banks, credit unions, and online payments services to make it easy and safe for customers to port banking data to a new financial service provider.

The CFPB argues customers need to have control over their data, but Hawkins told Ars that banks considered the controversial rule potentially allowing customers to transfer sensitive data in one click to be a “freaking nightmare.”

Banks warned of fraud risks and privacy concerns about sharing sensitive data with third parties that could profit off that data, possibly heightening risks of data breaches. Compliance isn’t required until 2026, but already the rule is being challenged in court, Hawkins said.

In one way, the new rule could be good for X, Hawkins told Ars, as the app could quickly gain access to valuable financial data if X users did switch from, say, using a bank to managing money through X Payments. Then X wouldn’t have “to go build all this data from scratch” to make X Payments profitable, Hawkins suggested.

But in another way, the rule could put X in “an interesting spot” where the app is required to share its user data with third parties in a way that could potentially have Musk second-guessing whether X would even benefit from becoming a bank in the way that he initially planned. Banks have protested the CFPB rule as allowing third parties to profit off data that they can’t, and Musk’s whole X Payments plan appears to revolve around profiting off users’ financial data.

“If somebody wants to pay with X, now X has to transfer the data to the third party, and they may not want to do that, because obviously, data is power, right?” Hawkins said.

Not a bank

But if Musk is suddenly shy about turning X into a bank, it comes at a time when banks are less likely to partner with social media apps for potentially risky new payment ventures.

Hawkins noted that banks have struggled to roll out new payment capabilities as easily as fintechs can, and that struggle inspired longtime partnerships between banks and tech companies that have recently begun to collapse. On Wednesday, the CFPB ordered Apple and Goldman Sachs to pay more than $89 million over “illegally mishandled transaction disputes.” Now Goldman Sachs is banned from offering new credit cards until it can be trusted to comply with laws. And Wells Fargo recently bowed out of PayPal and Square partnerships, citing compliance costs, The Information reported this week.

For Musk, who has notoriously butted heads with his trust and safety compliance teams at X, working with regulators on launching X Payments might, at this moment, seem less attractive.

“It’s one thing to want to move money on a payments app,” Hawkins told Ars. “It’s another thing to be a bank. Like he’s gonna hate being a bank.”

Earlier this year, the CFPB risked being dismantled after the financial services associations alleged its funding scheme was improper. But shortly after X withdrew from New York, the Supreme Court ruled in May that nothing was amiss with CFPB’s funding, despite Justice Samuel Alito warning in his dissent that SCOTUS’s decision meant the CFPB could “bankroll its own agenda without any congressional control or oversight,” Reuters reported.

In this strained environment, X could potentially overcome all obstacles and become a bank and fill a gap left by banks beginning to be spooked by fintech deals, Hawkins said, insisting that she would never bet against Musk, whose successes are many. But granting money transmitter licenses helps states prevent financial crimes through compliance requirements, and X quietly pulling out of New York earlier this year suggests that X may not be prepared to take on regulatory scrutiny at this current moment.

The last major development regarding X Payments came in August. It didn’t come from X leadership but from an app researcher, Nima Owji, who posted on X that “X Payments is coming soon!” Digging in X’s code, Owji apparently found references to new payments features enabling “transactions, balance, and transfer,” as well as a “Payments” button seemingly ready to be added to X’s bookmarks tab, TechCrunch reported.

But for Musk fans awaiting an official update, X executives’ silence on X Payments has been deafening since June, when Yaccarino forecast the feature would be coming soon, despite knowing that X had withdrawn its application for a money transmitter license from New York.

X continuing to hype the payments service without publicly disclosing the apparent speed bump in New York “doesn’t feel very honest,” Hawkins told Ars.

X still losing users, advertisers

It has been two years since Musk took over Twitter, soon after revealing that he intended to use Twitter’s userbase as the launchpad for an everything app that would be so engaging and useful that it would be the only app that anyone would ever need online.

Market intelligence firm Sensor Tower shared data with Ars showing that, compared to October 2022, when Musk bought Twitter, global daily average users on X were down 28 percent in September 2024.

Sensor Tower attributed part of the recent decline to X’s ban in Brazil driving out users but noted that overall, users “were down significantly compared to the pre-acquisition period,” as now-X “contended with a rise of controversial content and technical issues.”

While the decline in users could hurt Musk’s ambitions to launch a hugely popular payments app nested in X, the spike in offensive content has notably alienated advertisers who traditionally are X’s dominant source of revenue. And in lockstep with X’s decline in users, major brands have continued to shed the social app in 2024, Sensor Tower told Ars.

Last November, ad agencies flagged then-Twitter brand safety concerns, including GroupM marking Twitter “high risk” and Interpublic Group recommending that advertisers pause spending. By the end of last year, Sensor Tower reported that “of the company’s top 100 US advertisers in the days before” Musk purchased the platform, “only 50 were still there as of October 2023.”

The picture is even bleaker as X approaches the end of 2024, Sensor Tower’s data shows, estimating that “72 out of the top 100 spending US advertisers on X from October 2022 have ceased spending on the platform as of September 2024.” Compared to the first half of 2022, prior to Musk’s acquisition, X’s ad revenue from top 100 advertisers during the first half of 2024 was down 68 percent, Sensor Tower estimated.

Since becoming X’s CEO, Yaccarino has appeared most vocal about driving growth in X’s video services, allowing advertisers to avoid toxic content on the app by only running their ads alongside pre-approved creators’ content. In particular, Yaccarino has hyped X’s partnership with the NFL, announcing today on X that the partnership will be expanded.

That NFL partnership has seemingly helped X grow its ad revenue, with Sensor Tower estimating that “four out of the top 10 spending US advertisers on X in September 2024 were tied to sports or sports betting, likely in an attempt to capitalize on heightened consumer interest around the beginning of the NFL season.”

But overall, X’s revenue has not recovered in 2024, with Fidelity recently estimating that X is worth 80 percent less than when Musk bought the app, CNN reported.

Instead of working with advertisers, Musk went on the attack, suing the World Federation of Advertisers in August over what he calls an “illegal boycott” of X. But X’s spokesperson, Michael Abboud, linked Ars to an X post suggesting that X has held discussions with big brands about a brand safety solution.

“X is pleased to have reached an agreement with Unilever and to continue our partnership with them on the platform,” X’s post said. “Today’s news is the first part of the ecosystem-wide solution and we look forward to more resolution across the industry.”

Unilever did not respond to Ars’ request to comment on X’s proposed solution.

Musk’s strategy for monetizing X has always been to reduce reliance on advertising, but his everything app pursuit does not seem to be coming together as quickly as planned to make up for lost ad revenue. He initially projected that it would take three to five years to roll out all the features turning X into an everything app. But two years in, launching the core product experts say is critical to the success of everything apps like WeChat—X Payments—seems to be the major obstacle that Musk faces to manage the app without relying nearly entirely on advertisers’ meddling ideas regarding brand safety.

Hawkins said that Musk perhaps did not make a “great bet” when buying Twitter as the foundation of his everything app.

X “has continued to trend down in terms of profitability and users, and I’m sure he’s considering X Payments to be maybe a Hail Mary to try to pull X back into the black,” Hawkins said.

But by trying to disrupt the financial industry, Musk perhaps rashly “picked a highly regulated capability to bet the farm on,” Hawkins suggested.

As it stands now, it’s currently unclear when or if X Payments will launch, as the feed on the X account for Payments remains pointedly blank and Musk has not indicated whether X Payments can possibly launch without New York.

“I think it’s very telling he pulled out his application from New York, when he had even said in the media, there’s no point in doing this if I don’t have New York,” Hawkins said.

Ashley is a senior policy reporter for Ars Technica, dedicated to tracking social impacts of emerging policies and new technologies. She is a Chicago-based journalist with 20 years of experience.

X Payments delayed after Musk’s X weirdly withdrew application for NY license Read More »