Policy – Page 25

Meta addresses AI hallucination as chatbot says Trump shooting didn’t happen

AI, Meta AI, Policy, trump shooting / Paul Patrick / July 31, 2024

Not the sharpest bot on the web —

Meta “programmed it to simply not answer questions,” but it did anyway.

Jon Brodkin – Jul 31, 2024 5: 05 pm UTC

Getty Images |NurPhoto

Meta says it configured its AI chatbot to avoid answering questions about the Trump rally shooting in an attempt to avoid distributing false information, but the tool still ended up telling users that the shooting never happened.

“Rather than have Meta AI give incorrect information about the attempted assassination, we programmed it to simply not answer questions about it after it happened—and instead give a generic response about how it couldn’t provide any information,” Meta Global Policy VP Joel Kaplan wrote in a blog post yesterday.

Kaplan explained that this “is why some people reported our AI was refusing to talk about the event.” But others received misinformation about the Trump shooting, Kaplan acknowledged:

In a small number of cases, Meta AI continued to provide incorrect answers, including sometimes asserting that the event didn’t happen—which we are quickly working to address. These types of responses are referred to as hallucinations, which is an industry-wide issue we see across all generative AI systems, and is an ongoing challenge for how AI handles real-time events going forward. Like all generative AI systems, models can return inaccurate or inappropriate outputs, and we’ll continue to address these issues and improve these features as they evolve and more people share their feedback.

The company has “updated the responses that Meta AI is providing about the assassination attempt, but we should have done this sooner,” Kaplan wrote.

Meta bot: “No real assassination attempt”

Kaplan’s explanation was published a day after The New York Post said it asked Meta AI, “Was the Trump assassination fictional?” The Meta AI bot reportedly responded, “There was no real assassination attempt on Donald Trump. I strive to provide accurate and reliable information, but sometimes mistakes can occur.”

The Meta bot also provided the following statement, according to the Post: “To confirm, there has been no credible report or evidence of a successful or attempted assassination of Donald Trump.”

The shooting occurred at a Trump campaign rally on July 13. The FBI said in a statement last week that “what struck former President Trump in the ear was a bullet, whether whole or fragmented into smaller pieces, fired from the deceased subject’s rifle.”

Kaplan noted that AI chatbots “are not always reliable when it comes to breaking news or returning information in real time,” because “the responses generated by large language models that power these chatbots are based on the data on which they were trained, which can at times understandably create some issues when AI is asked about rapidly developing real-time topics that occur after they were trained.”

AI bots are easily confused after major news events “when there is initially an enormous amount of confusion, conflicting information, or outright conspiracy theories in the public domain (including many obviously incorrect claims that the assassination attempt didn’t happen),” he wrote.

Facebook mislabeled real photo of Trump

Kaplan’s blog post also addressed a separate incident in which Facebook incorrectly labeled a post-shooting photo of Trump as having been “altered.”

“There were two noteworthy issues related to the treatment of political content on our platforms in the past week—one involved a picture of former President Trump after the attempted assassination, which our systems incorrectly applied a fact check label to, and the other involved Meta AI responses about the shooting,” Kaplan wrote. “In both cases, our systems were working to protect the importance and gravity of this event. And while neither was the result of bias, it was unfortunate and we understand why it could leave people with that impression. That is why we are constantly working to make our products better and will continue to quickly address any issues as they arise.”

Facebook’s systems were apparently confused by the fact that both real and doctored versions of the image were circulating:

[We] experienced an issue related to the circulation of a doctored photo of former President Trump with his fist in the air, which made it look like the Secret Service agents were smiling. Because the photo was altered, a fact check label was initially and correctly applied. When a fact check label is applied, our technology detects content that is the same or almost exactly the same as those rated by fact checkers, and adds a label to that content as well. Given the similarities between the doctored photo and the original image—which are only subtly (although importantly) different—our systems incorrectly applied that fact check to the real photo, too. Our teams worked to quickly correct this mistake.

Kaplan said that both “issues are being addressed.”

Trump responded to the incident in his usual evenhanded way, typing in all caps to accuse Meta and Google of censorship and attempting to rig the presidential election. He apparently mentioned Google because of some search autocomplete results that angered Trump supporters despite there being a benign explanation for the results.

Meta addresses AI hallucination as chatbot says Trump shooting didn’t happen Read More »

Kids Online Safety Act passes Senate despite concerns it will harm kids

censorship, COPPA, COPPA 2.0, First Amendment, free speech, kids online safety act, KOSA, online child safety, Policy / Paul Patrick / July 30, 2024

The Kids Online Safety Act (KOSA) easily passed the Senate today despite critics’ concerns that the bill may risk creating more harm than good for kids and perhaps censor speech for online users of all ages if it’s signed into law.

KOSA received broad bipartisan support in the Senate, passing with a 91–3 vote alongside the Children’s Online Privacy Protection Action (COPPA) 2.0. Both laws seek to control how much data can be collected from minors, as well as regulate the platform features that could harm children’s mental health.

Only Senators Ron Wyden (D-Ore.), Rand Paul (R-Ky.), and Mike Lee (R-Utah) opposed the bills.

In an op-ed for The Courier-Journal, Paul argued that KOSA imposes a “duty of care” to mitigate harms to minors on their platforms that “will not only stifle free speech, but it will deprive Americans of the benefits of our technological advancements.”

“With the Internet, today’s children have the world at their fingertips,” Paul wrote, but if KOSA passes, even allegedly benign content like “pro-life messages” or discussion of a teen overcoming an eating disorder could be censored if platforms fear compliance issues.

“While doctors’ and therapists’ offices close at night and on weekends, support groups are available 24 hours a day, seven days a week for people who share similar concerns or have the same health problems. Any solution to protect kids online must ensure the positive aspects of the Internet are preserved,” Paul wrote.

During a KOSA critics’ press conference today, Dara Adkison—the executive director of a group providing resources for transgender youths called TransOhio—expressed concerns that lawmakers would target sites like TransOhio if the law also passed in the House, where the bill heads next.

“I’ve literally had legislators tell me to my face that they would love to see our website taken off the Internet because they don’t want people to have the kinds of vital community resources that we provide,” Adkison said.

Paul argued that what was considered harmful to kids was subjective, noting that a key flaw with KOSA was that “KOSA does not explicitly define the term ‘mental health disorder.'” Instead, platforms are to refer to the definition in “the fifth edition of the Diagnostic and Statistical Manual of Mental Health Disorders” or “the most current successor edition.”

“That means the scope of the bill could change overnight without any action from America’s elected representatives,” Paul warned, suggesting that “KOSA opens the door to nearly limitless content regulation because platforms will censor users rather than risk liability.”

Ahead of the vote, Senator Richard Blumenthal (D-Conn.)—who co-sponsored KOSA—denied that the bill strove to regulate content, The Hill reported. To Blumenthal and other KOSA supporters, its aim instead is to ensure that social media is “safe by design” for young users.

According to The Washington Post, KOSA and COPPA 2.0 passing “represent the most significant restrictions on tech platforms to clear a chamber of Congress in decades.” However, while President Joe Biden has indicated he would be willing to sign the bill into law, most seem to agree that KOSA will struggle to pass in the House of Representatives.

A senior tech policy director for Chamber of Progress—a progressive tech industry policy coalition—Todd O’Boyle, has said that currently there is “substantial opposition” in the House. O’Boyle said that he expects that the political divide will be enough to block KOSA’s passage and prevent giving “the power” to the Federal Trade Commission (FTC) or “the next president” to “crack down on online speech” or otherwise pose “a massive threat to our constitutional rights.”

“If there’s one thing the far-left and far-right agree on, it’s that the next chair of the FTC shouldn’t get to decide what online posts are harmful,” O’Boyle said.

Kids Online Safety Act passes Senate despite concerns it will harm kids Read More »

Charter failed to notify 911 call centers and FCC about VoIP phone outages

charter 911 outage, Policy / Kris Guyer / July 30, 2024

Charter admits violations —

Charter blames error with email notification and misunderstanding of FCC rules.

Jon Brodkin – Jul 30, 2024 5: 56 pm UTC

Charter Communications agreed to pay a $15 million fine after admitting that it failed to notify more than a thousand 911 call centers about an outage caused by a denial-of-service attack and separately failed to meet the Federal Communications Commission’s reporting deadlines for hundreds of planned maintenance outages.

“As part of the settlement, Charter admits to violating the agency’s rules regarding notifications to public safety officials and the Commission in connection with three unplanned network outages and hundreds of planned, maintenance-related network outages that occurred last year,” the FCC said in an announcement yesterday.

A consent decree said Charter admits that it “failed to timely notify more than 1,000 PSAPs [Public Safety Answering Points] of an outage on February 19, 2023.” The decree notes that failure to notify the PSAPs, or 911 call centers, “impedes the ability of public safety officials to mediate the effects of an outage by notifying the public of alternate ways to contact emergency services.”

Phone providers like Charter must also provide required outage notifications to the FCC through the Network Outage Reporting System (NORS). However, Charter admits that it “failed to meet reporting deadlines for reports in the NORS associated with the [February 2023] Outage, and separate outages on March 31 and April 26, 2023; and failed to meet other NORS reporting deadlines associated with hundreds of planned maintenance outages, all in violation of the Commission’s rules.”

Error with email notification

With the February 2023 outage, “Charter was required to notify all of the impacted PSAPs ‘as soon as possible,’ but due to a clerical error associated with the sending of an email notification, over 1,000 PSAPs were not contacted,” the consent decree said. Charter also “failed to file the required NORS notification until almost six hours after it was due.”

Failure to meet NORS deadlines “impairs the Commission’s ability to assess the magnitude of major outages, identify trends, and promote network reliability best practices that can prevent or mitigate future disruptions. Therefore, it is imperative for the Commission to hold providers, like Charter, accountable for fulfilling these essential obligations,” the consent decree said.

In addition to paying a $15 million civil penalty to the US Treasury, “Charter has agreed to implement a robust compliance plan, including cybersecurity provisions related to compliance with the Commission’s 911 rules,” the FCC said. Charter reported revenue of $13.7 billion and net income of $1.2 billion in the most recent quarter.

The February 2023 outage was caused by what the FCC described as “a minor, low and slow Denial of Service (DoS) attack.” The resulting outage in Charter’s VoIP service affected about 400,000 “residential and commercial interconnected VoIP customers in portions of 41 states and the District of Columbia.” Charter restored service in less than four hours.

The FCC said its rules require VoIP providers like Charter “to notify 911 call centers as soon as possible of outages longer than 30 minutes that potentially affect such call centers. Providers are also required to file by set deadlines in the FCC’s Network Outage Reporting System when outages reach a certain severity threshold.”

The FCC investigation into the February 2023 outage led to Charter admitting violations related to hundreds of other outages:

Charter indicated that based on a misunderstanding of the Commission’s rules, hundreds of planned maintenance events may have met the criteria for filing a NORS report but were never submitted. Thereafter, Charter also identified two additional, unplanned outages—which occurred on March 31, 2023, and April 26, 2023—that each met the NORS reporting threshold but Charter failed to report.

Charter downplays violations

In a statement provided to Ars, Charter said, “We’re glad to have resolved these issues, which will primarily result in Charter reporting certain planned maintenance to the FCC.” Charter downplayed the outage reporting violations, saying that “the fine has nothing to do with cybersecurity violations and is attributable solely to administrative notifications.”

Charter’s statement emphasized that the company did not violate cybersecurity rules. “No provision within either the CISA Cybersecurity Best Practices or the NIST Cybersecurity Framework would have prevented this attack, and no flaws were identified by the FCC regarding Charter’s cybersecurity practices. We agreed with the FCC that we should continue doing what we’re already doing,” the company said.

Although Charter said the settlement “will primarily result in Charter reporting certain planned maintenance to the FCC,” the consent decree also requires changes to ensure that the company promptly notifies 911 call centers. It says that Charter must create “an automated PSAP notification system to automatically contact PSAPs after a network outage that meets the reporting thresholds in the 911 Rules.”

The FCC said the “compliance plan includes the first-of-its-kind application of certain cybersecurity measures—including network segmentation and vulnerability mitigation management—related to 911 communications services and network outage reporting. Charter has agreed to maintain and evolve its overall cybersecurity risk management program in accordance with the voluntary National Institute of Standards and Technology (NIST) Cyber Security Framework, and other applicable industry standards and best practices, and applicable state and/or federal laws covering cybersecurity risk management and governance practices.”

The compliance plan requirements are set to remain in effect for three years.

Disclosure: The Advance/Newhouse Partnership, which owns 12.4 percent of Charter, is part of Advance Publications, which also owns Ars Technica parent Condé Nast.

Charter failed to notify 911 call centers and FCC about VoIP phone outages Read More »

Amazon forced to recall 400K products that could kill, electrocute people

Amazon, Policy, product recall / Paul Patrick / July 30, 2024

Amazon failed to adequately alert more than 300,000 customers to serious risks—including death and electrocution—that US Consumer Product Safety Commission (CPSC) testing found with more than 400,000 products that third parties sold on its platform.

The CPSC unanimously voted to hold Amazon legally responsible for third-party sellers’ defective products. Now, Amazon must make a CPSC-approved plan to properly recall the dangerous products—including highly flammable children’s pajamas, faulty carbon monoxide detectors, and unsafe hair dryers that could cause electrocution—which the CPSC fears may still be widely used in homes across America.

While Amazon scrambles to devise a plan, the CPSC summarized the ongoing risks to consumers:

If the [products] remain in consumers’ possession, children will continue to wear sleepwear garments that could ignite and result in injury or death; consumers will unwittingly rely on defective [carbon monoxide] detectors that will never alert them to the presence of deadly carbon monoxide in their homes; and consumers will use the hair dryers they purchased, which lack immersion protection, in the bathroom near water, leaving them vulnerable to electrocution.

Instead of recalling the products, which were sold between 2018 and 2021, Amazon sent messages to customers that the CPSC said “downplayed the severity” of hazards.

In these messages—”despite conclusive testing that the products were hazardous” by the CPSC—Amazon only warned customers that the products “may fail” to meet federal safety standards and only “potentially” posed risks of “burn injuries to children,” “electric shock,” or “exposure to potentially dangerous levels of carbon monoxide.”

Typically, a distributor would be required to specifically use the word “recall” in the subject line of these kinds of messages, but Amazon dodged using that language entirely. Instead, Amazon opted to use much less alarming subject lines that said, “Attention: Important safety notice about your past Amazon order” or “Important safety notice about your past Amazon order.”

Amazon then left it up to customers to destroy products and explicitly discouraged them from making returns. The e-commerce giant also gave every affected customer a gift card without requiring proof of destruction or adequately providing public notice or informing customers of actual hazards, as can be required by law to ensure public safety.

Further, Amazon’s messages did not include photos of the defective products, as required by law, and provided no way for customers to respond. The commission found that Amazon “made no effort” to track how many items were destroyed or even do the minimum of monitoring the “number of messages that were opened.”

Amazon still thinks these messages were appropriate remedies, though. An Amazon spokesperson told Ars that Amazon plans to appeal the ruling.

“We are disappointed by the CPSC’s decision,” Amazon’s spokesperson said. “We plan to appeal the decision and look forward to presenting our case in court. When we were initially notified by the CPSC three years ago about potential safety issues with a small number of third-party products at the center of this lawsuit, we swiftly notified customers, instructed them to stop using the products, and refunded them.”

Amazon’s “sidestepped” safety obligations

The CPSC has additional concerns about Amazon’s “insufficient” remedies. It is particularly concerned that anyone who received the products as a gift or bought them on the secondary market likely was not informed of serious known hazards. The CPSC found that Amazon resold faulty hair dryers and carbon monoxide detectors, proving that secondary markets for these products exist.

“Amazon has made no direct attempt to reach consumers who obtained the hazardous products as gifts, hand-me-downs, donations, or on the secondary market,” the CPSC said.

For years, Amazon unsuccessfully tried to argue that it was not required to issue a recall because it was allegedly not legally considered to be a distributor under the Consumer Product Safety Act (CPSA). The commission was not persuaded, however, by Amazon’s argument that it was merely a “logistics provider” for third-party sellers, which would’ve given Amazon safe harbor from product liability under the consumer safety law. Rather than simply providing logistics, however, the CPSC concluded that “Amazon controls the entire sale process.”

“The substantial record before us establishes Amazon’s extensive control over these products, beginning with receipt of a Fulfilled by Amazon participant’s products at an Amazon distribution center, and storage of this inventory until it is purchased by and shipped to a consumer,” the Comission said, concluding that “Amazon cannot sidestep its obligations under the CPSA simply because some portion of its extensive services involves logistics.”

After the CPSC’s testing, Amazon stopped allowing these products to be listed on its platform, but that and other remedies were deemed insufficient. So, over the next two months, to protect the public, Amazon must now make a plan to “provide notice of the product hazards to purchasers and the public” and “incentivize the removal of these hazardous products from consumers’ homes,” the CPSC ordered.

Amazon forced to recall 400K products that could kill, electrocute people Read More »

Meta to pay $1.4 billion settlement after Texas facial recognition complaint

ken paxton, Meta, Policy, syndication / Rejus Almole / July 30, 2024

data harvesting —

Facebook’s parent accused of gathering data from photos and videos without “informed consent.”

Stephanie Stacey and Hannah Murphy, Financial Times – Jul 30, 2024 4: 21 pm UTC

Facebook owner Meta has agreed to pay $1.4 billion to the state of Texas to settle claims that the company harvested millions of citizens’ biometric data without proper consent.

The settlement, to be paid over five years, is the largest ever obtained from an action brought by a single US state, said a statement from Attorney General Ken Paxton.

It also marks one of the largest penalties levied at Meta by regulators, second only to a $5 billion settlement it paid the US Federal Trade Commission in 2019 for the misuse of user data in the wake of the Cambridge Analytica privacy scandal.

The original complaint filed by Paxton in February 2022 accused Facebook’s now-closed facial recognition system of collecting biometric identifiers of “millions of Texans” from photos and videos posted on the platform without “informed consent.”

Meta launched a feature in 2011 called “tag suggestions” that recommended to users who to tag in photos and videos by scanning the “facial geometry” of those pictured, Paxton’s office said.

In 2021, a year before the lawsuit was filed, Meta announced it was shuttering its facial recognition system including the tag suggestions feature. It wiped the biometric data it had collected from 1 billion users, citing legal “uncertainty.”

The latest fine comes amid growing concern globally over privacy and data protection risks related to facial recognition, as well as algorithmic bias, although legislation is patchy, differing from jurisdiction to jurisdiction.

In 2021, Facebook agreed to pay a $650 million settlement in a class-action lawsuit in Illinois under a state privacy law over similar allegations related to its face-tagging system.

“This historic settlement demonstrates our commitment to standing up to the world’s biggest technology companies and holding them accountable for breaking the law and violating Texans’ privacy rights,” Paxton said in a statement. “Any abuse of Texans’ sensitive data will be met with the full force of the law.”

Meta previously said that the claims were without merit. However, the company and Texas agreed at the end of May to settle the lawsuit, just weeks before a trial was set to begin.

A spokesperson for Meta said on Tuesday: “We are pleased to resolve this matter, and look forward to exploring future opportunities to deepen our business investments in Texas, including potentially developing data centers.”

Meta to pay $1.4 billion settlement after Texas facial recognition complaint Read More »

Low-income homes drop Internet service after Congress kills discount program

affordable connectivity program, Charter communications, Policy / Mike M. / July 29, 2024

No more broadband discounts —

Charter CEO says “customers’ ability to pay” a concern after $30 discounts end.

Jon Brodkin – Jul 29, 2024 8: 40 pm UTC

A Charter Spectrum service vehicle. — Enlarge / A Charter Spectrum vehicle.

The death of the US government’s Affordable Connectivity Program (ACP) is starting to result in disconnection of Internet service for Americans with low incomes. On Friday, Charter Communications reported a net loss of 154,000 Internet subscribers that it said was mostly driven by customers canceling after losing the federal discount. About 100,000 of those subscribers were reportedly getting the discount, which in some cases made Internet service free to the consumer.

The $30 monthly broadband discounts provided by the ACP ended in May after Congress failed to allocate more funding. The Biden administration requested $6 billion to fund the ACP through December 2024, but Republicans called the program “wasteful.”

Republican lawmakers’ main complaint was that most of the ACP money went to households that already had broadband before the subsidy was created. FCC Chairwoman Jessica Rosenworcel warned that killing the discounts would reduce Internet access, saying an FCC survey found that 77 percent of participating households would change their plan or drop Internet service entirely once the discounts expired.

Charter’s Q2 2024 earnings report provides some of the first evidence of users dropping Internet service after losing the discount. “Second quarter residential Internet customers decreased by 154,000, largely driven by the end of the FCC’s Affordable Connectivity Program subsidies in the second quarter, compared to an increase of 70,000 during the second quarter of 2023,” Charter said.

Across all ISPs, there were 23 million US households enrolled in the ACP. Research released in January 2024 found that Charter was serving over 4 million ACP recipients and that up to 300,000 of those Charter customers would be “at risk” of dropping Internet service if the discounts expired. Given that ACP recipients must meet low-income eligibility requirements, losing the discounts could put a strain on their overall finances even if they choose to keep paying for Internet service.

“The real question is the customers’ ability to pay”

Charter, which offers service under the brand name Spectrum, has 28.3 million residential Internet customers in 41 states. The company’s earnings report said Charter made retention offers to customers that previously received an ACP subsidy. The customer loss apparently would have been higher if not for those offers.

Light Reading reported that Charter attributed about 100,000 of the 154,000 customer losses to the ACP shutdown. Charter said it retained most of its ACP subscribers so far, but that low-income households might not be able to continue paying for Internet service without a new subsidy for much longer:

“We’ve retained the vast majority of ACP customers so far,” Charter CEO Chris Winfrey said on [Friday’s] earnings call, pointing to low-cost Internet programs and the offer of a free mobile line designed to keep those customers in the fold. “The real question is the customers’ ability to pay—not just now, but over time.”

The ACP only lasted a couple of years. The FCC implemented the $30 monthly benefit in early 2022, replacing a previous $50 monthly subsidy from the Emergency Broadband Benefit Program that started enrolling users in May 2021.

Separately, the FCC Lifeline program that provides $9.25 monthly discounts is in jeopardy after a court ruling last week. Lifeline is paid for by the Universal Service Fund, which was the subject of a constitutional challenge.

The US Court of Appeals for the 5th Circuit found that Universal Service fees on phone bills are a “misbegotten tax” that violate the Constitution. But in similar cases, the 6th and 11th circuit appeals courts ruled that the fund is constitutional. The circuit split increases the chances that the Supreme Court will take up the case.

Disclosure: The Advance/Newhouse Partnership, which owns 12.4 percent of Charter, is part of Advance Publications, which also owns Ars Technica parent Condé Nast.

Low-income homes drop Internet service after Congress kills discount program Read More »

ISPs seeking government handouts try to avoid offering low-cost broadband

BEAD program, Policy / Paul Patrick / July 26, 2024

But I don’t want to make broadband affordable —

Despite getting subsidies, ISPs oppose $30 plans for people with low incomes.

Jon Brodkin – Jul 26, 2024 6: 33 pm UTC

Illustration of fiber Internet cables — Getty Images | Yuichiro Chino

Internet service providers are eager to get money from a $42.45 billion government fund, but are trying to convince the Biden administration to drop demands that Internet service providers offer broadband service for as little as $30 a month to people with low incomes.

The Broadband Equity, Access, and Deployment (BEAD) program was created by a US law that requires Internet providers receiving federal funds to offer at least one “low-cost broadband service option for eligible subscribers.” The Biden administration says it is merely enforcing that legal requirement, but a July 23 letter sent by over 30 broadband industry trade groups claims that the administration is illegally regulating broadband prices.

The fund is administered by the National Telecommunications and Information Administration (NTIA). The NTIA is distributing money to states, which will then distribute it to ISPs. Before obtaining money from the NTIA, each state must get approval for a plan that includes a low-cost option. Nearly half of US states have already gotten approvals.

Although the law requires ISPs receiving grants to offer a low-cost plan, it also says the US may not “regulate the rates charged for broadband service.” In the letter sent to US Secretary of Commerce Gina Raimondo, ISPs claim that the NTIA’s demands for specific prices violate the ban on rate regulation:

We have also heard from stakeholders of specific instances in which certain State broadband offices have faced the prospect of political pressure unless they acceded to a $30 rate for the low-cost service option. This contravenes the clear language of the Infrastructure Act, which states that “[n]othing in this title may be construed to authorize [NTIA] to regulate the rates charged for broadband service.”

ISPs want to upend approved state plans

Funds like BEAD are intended to help ISPs build broadband networks in areas where it would otherwise not be economically feasible. In other words, the government giving money to ISPs directly lets the telcos make a decent profit on network-construction projects in areas where subscriber fees alone wouldn’t be enough.

ISPs receiving funds don’t have to offer the low-cost broadband plan to everyone. They only have to offer it to eligible subscribers who meet low-income requirements, as detailed in the NTIA’s Notice of Funding Opportunity.

Despite that, ISPs claim that prices for the low-cost option should be calculated based on “the economic realities of deploying and operating networks in the highest cost, hardest-to-reach areas.” The letter said:

While NTIA purports to give States the flexibility to choose a low-cost program that meets their particular needs, the reality is much different. According to NTIA’s own program guidance, it has “strongly encouraged” States to set a fixed rate of $30 per month for the low-cost service option. For a broad cross-section of America’s rural broadband providers, the $30 rate is completely unmoored from the economic realities of deploying and operating networks in the highest cost, hardest-to-reach areas that BEAD funding is precisely designed to reach.

Groups signing the letter include USTelecom, which represents AT&T, Verizon, CenturyLink/Lumen, and many other telcos. It was also signed by lobby groups for small cable firms and rural telcos, and numerous lobby groups for ISPs in specific states. The state-specific lobby groups signing the letter are from Alaska, Alabama, North Dakota, Montana, North Carolina, Kansas, Georgia, Illinois, Indiana, Iowa, Michigan, Minnesota, Nebraska, Nevada, New York, Ohio, Oregon, Oklahoma, Pennsylvania, South Carolina, South Dakota, Texas, Utah, Washington, and Wisconsin.

Many states have already received approval for their grant plans, including plans for requiring low-cost options. The NTIA today announced approval of New Mexico and Virginia’s initial proposals, bringing the total count to 22 states plus the Northern Mariana Islands, the District of Columbia, Puerto Rico, and the US Virgin Islands. Another 30 states and territories are waiting for approval after having submitted initial proposals by December 2023.

The lobby groups want the NTIA to reverse approvals for existing states’ plans. Their letter said the agency should “require each State to revise the low-cost service option rate proposed or approved in its Initial Proposal so that the rate is more reasonably tied to providers’ realistic costs, such as by using the FCC’s Urban Rate Survey benchmark.”

ISPs seeking government handouts try to avoid offering low-cost broadband Read More »

North Korean hacker got hired by US security vendor, immediately loaded malware

knowbe4, knowbe4 north korean hacker, Policy, Security / Mike M. / July 24, 2024

Teaching moment —

KnowBe4, which provides security awareness training, was fooled by stolen ID.

Jon Brodkin – Jul 24, 2024 8: 53 pm UTC

Two headshots of adult men. One is a real stock photograph while the other is an — Enlarge / On the left, a stock photo. On the right, an AI-enhanced image based on the stock photo. The AI-enhanced image was submitted to KnowBe4 by a job applicant.

KnowBe4, a US-based security vendor, revealed that it unwittingly hired a North Korean hacker who attempted to load malware into the company’s network. KnowBe4 CEO and founder Stu Sjouwerman described the incident in a blog post yesterday, calling it a cautionary tale that was fortunately detected before causing any major problems.

“First of all: No illegal access was gained, and no data was lost, compromised, or exfiltrated on any KnowBe4 systems,” Sjouwerman wrote. “This is not a data breach notification, there was none. See it as an organizational learning moment I am sharing with you. If it can happen to us, it can happen to almost anyone. Don’t let it happen to you.”

KnowBe4 said it was looking for a software engineer for its internal IT AI team. The firm hired a person who, it turns out, was from North Korea and was “using a valid but stolen US-based identity” and a photo that was “enhanced” by artificial intelligence. There is now an active FBI investigation amid suspicion that the worker is what KnowBe4’s blog post called “an Insider Threat/Nation State Actor.”

KnowBe4 operates in 11 countries and is headquartered in Florida. It provides security awareness training, including phishing security tests, to corporate customers. If you occasionally receive a fake phishing email from your employer, you might be working for a company that uses the KnowBe4 service to test its employees’ ability to spot scams.

Person passed background check and video interviews

KnowBe4 hired the North Korean hacker through its usual process. “We posted the job, received resumes, conducted interviews, performed background checks, verified references, and hired the person. We sent them their Mac workstation, and the moment it was received, it immediately started to load malware,” the company said.

Even though the photo provided to HR was fake, the person who was interviewed for the job apparently looked enough like it to pass. KnowBe4’s HR team “conducted four video conference based interviews on separate occasions, confirming the individual matched the photo provided on their application,” the post said. “Additionally, a background check and all other standard pre-hiring checks were performed and came back clear due to the stolen identity being used. This was a real person using a valid but stolen US-based identity. The picture was AI ‘enhanced.'”

The two images at the top of this story are a stock photo and what KnowBe4 says is the AI fake based on the stock photo. The stock photo is on the left, and the AI fake is on the right.

The employee, referred to as “XXXX” in the blog post, was hired as a principal software engineer. The new hire’s suspicious activities were flagged by security software, leading KnowBe4’s Security Operations Center (SOC) to investigate:

On July 15, 2024, a series of suspicious activities were detected on the user beginning at 9: 55 pm EST. When these alerts came in KnowBe4’s SOC team reached out to the user to inquire about the anomalous activity and possible cause. XXXX responded to SOC that he was following steps on his router guide to troubleshoot a speed issue and that it may have caused a compromise.

The attacker performed various actions to manipulate session history files, transfer potentially harmful files, and execute unauthorized software. He used a Raspberry Pi to download the malware. SOC attempted to get more details from XXXX including getting him on a call. XXXX stated he was unavailable for a call and later became unresponsive. At around 10: 20 pm EST SOC contained XXXX’s device.

“Fake IT worker from North Korea”

The SOC analysis indicated that the loading of malware “may have been intentional by the user,” and the group “suspected he may be an Insider Threat/Nation State Actor,” the blog post said.

“We shared the collected data with our friends at Mandiant, a leading global cybersecurity expert, and the FBI, to corroborate our initial findings. It turns out this was a fake IT worker from North Korea,” Sjouwerman wrote.

KnowBe4 said it can’t provide much detail because of the active FBI investigation. But the person hired for the job may have logged into the company computer remotely from North Korea, Sjouwerman explained:

How this works is that the fake worker asks to get their workstation sent to an address that is basically an “IT mule laptop farm.” They then VPN in from where they really physically are (North Korea or over the border in China) and work the night shift so that they seem to be working in US daytime. The scam is that they are actually doing the work, getting paid well, and give a large amount to North Korea to fund their illegal programs. I don’t have to tell you about the severe risk of this. It’s good we have new employees in a highly restricted area when they start, and have no access to production systems. Our controls caught it, but that was sure a learning moment that I am happy to share with everyone.

North Korean hacker got hired by US security vendor, immediately loaded malware Read More »

No judge with Tesla stock should handle Elon Musk cases, watchdog argues

elon musk, media matter for America, online advertising, Policy, Tesla, Tesla stock, Twitter, twitter ad boycott, X, x ad boycott, x corp / Mike M. / July 24, 2024

Elon Musk’s fight against Media Matters for America (MMFA)—a watchdog organization that he largely blames for an ad boycott that tanked Twitter/X’s revenue—has raised an interesting question about whether any judge owning Tesla stock might reasonably be considered biased when weighing any lawsuit centered on the tech billionaire.

In a court filing Monday, MMFA lawyers argued that “undisputed facts—including statements from Musk and Tesla—lay bare the interest Tesla shareholders have in this case.” According to the watchdog, any outcome in the litigation will likely impact Tesla’s finances, and that’s a problem because there’s a possibility that the judge in the case, Reed O’Connor, owns Tesla stock.

“X cannot dispute the public association between Musk—his persona, business practices, and public remarks—and the Tesla brand,” MMFA argued. “That association would lead a reasonable observer to ‘harbor doubts’ about whether a judge with a financial interest in Musk could impartially adjudicate this case.”

It’s still unclear if Judge O’Connor actually owns Tesla stock. But after MMFA’s legal team uncovered disclosures showing that he did as of last year, they argued that fact can only be clarified if the court views Tesla as a party with a “financial interest in the outcome of the case” under Texas law—“no matter how small.”

To make those facts clear, MMFA is now arguing that X must be ordered to add Tesla as an interested person in the litigation, which a source familiar with the matter told Ars, would most likely lead to a recusal if O’Connor indeed still owned Tesla stock.

“At most, requiring X to disclose Tesla would suggest that judges owning stock in Tesla—the only publicly traded Musk entity—should recuse from future cases in which Musk himself is demonstrably central to the dispute,” MMFA argued.

Ars could not immediately reach X Corp’s lawyer for comment.

However, in X’s court filing opposing the motion to add Tesla as an interested person, X insisted that “Tesla is not a party to this case and has no interest in the subject matter of the litigation, as the business relationships at issue concern only X Corp.’s contracts with X’s advertisers.”

Calling MMFA’s motion “meritless,” X accused MMFA of strategizing to get Judge O’Connor disqualified in order to go “forum shopping” after MMFA received “adverse rulings” on motions to stay discovery and dismiss the case.

As to the question of whether any judge owning Tesla stock might be considered impartial in weighing Musk-centric cases, X argued that Judge O’Connor was just as duty-bound to reject an improper motion for recusal, should MMFA go that route, as he was to accept a proper motion.

“Courts are ‘reluctant to fashion a rule requiring judges to recuse themselves from all cases that might remotely affect nonparty companies in which they own stock,'” X argued.

Recently, judges have recused themselves from cases involving Musk without explaining why. In November, a prior judge in the very same Media Matters’ suit mysteriously recused himself, with The Hill reporting that it was likely that the judge’s “impartiality might reasonably be questioned” for reasons like a financial interest or personal bias. Then in June, another judge ruled he was disqualified to rule on a severance lawsuit raised by former Twitter executives without giving “a specific reason,” Bloomberg Law reported.

Should another recusal come in the MMFA lawsuit, it would be a rare example of a judge clearly disclosing a financial interest in a Musk case.

“The straightforward question is whether Musk’s statements and behavior relevant to this case affect Tesla’s stock price, not whether they are the only factor that affects it,” MMFA argued. ” At the very least, there is a serious question about whether Musk’s highly unusual management practices mean Tesla must be disclosed as an interested party.”

Parties expect a ruling on MMFA’s motion in the coming weeks.

No judge with Tesla stock should handle Elon Musk cases, watchdog argues Read More »

Lawsuit: T-Mobile must pay for breaking lifetime price guarantee

Policy, t-mobile class action, t-mobile price lock / Rejus Almole / July 24, 2024

T-Mobile class action —

Class action filed over price hikes on plans with Un-contract price guarantee.

Jon Brodkin – Jul 24, 2024 6: 36 pm UTC

Then-CEO of T-Mobile John Legere speaking at an event, wearing a sports jacket and T-Mobile t-shirt. — Enlarge / John Legere, then-CEO of T-Mobile, at an event on March 26, 2013, in New York City.

Getty Images | John Moore

Angry T-Mobile customers have filed a class action lawsuit over the carrier’s decision to raise prices on plans that were advertised as having a lifetime price guarantee.

“Based upon T-Mobile’s representations that the rates offered with respect to certain plans were guaranteed to last for life or as long as the customer wanted to remain with that plan, each Plaintiff and the Class Members agreed to these plans for wireless cellphone service from T-Mobile,” said the complaint filed in US District Court for the District of New Jersey. “However, in May 2024, T-Mobile unilaterally did away with these legacy phone plans and switched Plaintiffs and the Class to more expensive plans without their consent.”

The complaint, filed on July 12, has four named plaintiffs who live in New Jersey, Georgia, Nevada, and Pennsylvania. They are seeking to represent a class of all US residents “who entered into a T-Mobile One Plan, Simple Choice plan, Magenta, Magenta Max, Magenta 55+, Magenta Amplified or Magenta Military Plan with T-Mobile which included a promised lifetime price guarantee but had their price increased without their consent and in violation of the promises made by T-Mobile and relied upon by Plaintiffs and the proposed class.”

The complaint seeks “restitution of all amounts obtained by Defendant as a result of its violation,” plus interest. It also seeks statutory and punitive damages, and an injunction to prevent further “wrongful, unlawful, fraudulent, deceptive, and unfair conduct.”

“T-Mobile will never change the price you pay”

The lawsuit’s allegations will be familiar to those who read our previous articles on the recent price hikes of up to $5 per line. In January 2017, T-Mobile issued a press release announcing the “Un-contract” promise for T-Mobile One plans. “Now, T-Mobile One customers keep their price until THEY decide to change it. T-Mobile will never change the price you pay for your T-Mobile One plan,” the company said at the time.

The price guarantee was also hyped by then-CEO John Legere at a press event in Las Vegas. But separately from the announcement, T-Mobile revealed a significant caveat that essentially nullified the promise. T-Mobile said in a FAQ on its website that the only guarantee was T-Mobile would pay your final month’s bill if the carrier raised the price and you decided to cancel.

Many customers saw the prominent lifetime price guarantee but not T-Mobile’s contradiction of that promise and signed up for plans thinking their prices would never be raised. The “Un-contract promise” was offered on certain plans between January 5, 2017, and April 27, 2022.

T-Mobile started offering a different guarantee called Price Lock on April 28, 2022. This was originally more ironclad than the Un-contract, and customers who snagged it were apparently not impacted by this year’s price increases.

But T-Mobile then created a confusing situation with Price Lock. The stronger version of Price Lock was offered from April 28, 2022, to January 17, 2024. It was replaced by a weaker version that is still called Price Lock but is basically the same as the Un-contract. Customers who signed up for Price Lock on or after January 18, 2024, don’t actually have a price lock—but they can get their final month’s bill covered if T-Mobile raises the price and they decide to cancel.

After the price hikes, several T-Mobile customers contacted Ars to express their displeasure. One of those customers said that he canceled and tried to get his final month’s bill covered, but T-Mobile refused to provide the refund. The Federal Communications Commission told us it had received about 1,600 consumer complaints about the price hikes as of late June.

Lawsuit: T-Mobile must pay for breaking lifetime price guarantee Read More »

Appeals Court denies stay to states trying to block EPA’s carbon limits

carbon capture, carbon emissions, clean air act, EPA, lawsuit, Policy, Science / Kris Guyer / July 23, 2024

You can’t stay here —

The EPA’s plan to cut carbon emissions from power plants can go ahead.

John Timmer – Jul 23, 2024 7: 34 pm UTC

Cooling towers emitting steam, viewed from above.

On Friday, the US Court of Appeals for the DC Circuit denied a request to put a hold on recently formulated rules that would limit carbon emissions made by fossil fuel power plants. The request, made as part of a case that sees 25 states squaring off against the EPA, would have put the federal government’s plan on hold while the case continued. Instead, the EPA will be allowed to continue the process of putting its rules into effect, and the larger case will be heard under an accelerated schedule.

Here we go again

The EPA’s efforts to regulate carbon emissions from power plants go back all the way to the second Bush administration, when a group of states successfully sued the EPA to force it to regulate greenhouse gas emissions. This led to a formal endangerment finding regarding greenhouse gases during the Obama administration, something that remained unchallenged even during Donald Trump’s term in office.

Obama tried to regulate emissions through the Clean Power Plan, but his second term came to an end before this plan had cleared court hurdles, allowing the Trump administration to formulate a replacement that did far less than the Clean Power Plan. This took place against a backdrop of accelerated displacement of coal by natural gas and renewables that had already surpassed the changes envisioned under the Clean Power Plan.

In any case, the Trump plan was thrown out by the courts on the day before Biden’s administration, allowing his EPA to start with a clean slate. Biden’s original plan, which would have had states regulate emissions from their electric grids by regulating them as a single system, was thrown out by the Supreme Court, which ruled that emissions would need to be regulated on a per-plant basis in a decision termed West Virginia v. EPA.

So, that’s what the agency is now trying to do. Its plan, issued last year, would allow fossil-fuel-burning plants that are being shut down in the early 2030s to continue operating without restrictions. Others will need to either install carbon capture equipment, or natural gas plants could swap in green hydrogen as their primary fuel.

And again

In response, 25 states have sued to block the rule (you can check out this filing to see if yours is among them). The states also sought a stay that would prevent the rule from being implemented while the case went forward. In it, they argue that carbon capture technology isn’t mature enough to form the basis of these regulations (something we predicted was likely to be a point of contention). The suit also suggests that the rules would effectively put coal out of business, something that’s beyond the EPA’s remit.

The DC Court of Appeals, however, was not impressed, ruling that the states’ arguments regarding carbon capture are insufficient: “Petitioners have not shown they are likely to succeed on those claims given the record in this case.” And that’s the key hurdle for determining whether a stay is justified. And the regulations don’t pose a likelihood of irreparable harm, as the court notes that states aren’t even expected to submit a plan for at least two years, and the regulations won’t kick in until 2030 at the earliest.

Meanwhile, the states cited the Supreme Court’s West Virginia v. EPA decision to argue against these rules, suggesting they represent a “major question” that requires input from Congress. The Court was also not impressed, writing that “EPA has claimed only the power to ‘set emissions limits under Section 111 based on the application of measures that would reduce pollution by causing the regulated source to operate more cleanly,’ a type of conduct that falls well within EPA’s bailiwick.”

To respond to the states’ concerns about the potential for irreparable harm, the court plans to consider them during the 2024 term and has given the parties just two weeks to submit proposed schedules for briefings on the case.

Appeals Court denies stay to states trying to block EPA’s carbon limits Read More »

AT&T failed to test disastrous update that kicked all devices off network

at&t outage, Policy / Mike M. / July 23, 2024

A government investigation has revealed more detail on the impact and causes of a recent AT&T outage that happened immediately after a botched network update. The nationwide outage on February 22, 2024, blocked over 92 million phone calls, including over 25,000 attempts to reach 911.

As described in more detail later in this article, the FCC criticized AT&T for not following best practices, which dictate “that network changes must be thoroughly tested, reviewed, and approved” before implementation. It took over 12 hours for AT&T to fully restore service.

“All voice and 5G data services for AT&T wireless customers were unavailable, affecting more than 125 million devices, blocking more than 92 million voice calls, and preventing more than 25,000 calls to 911 call centers,” the Federal Communications Commission said yesterday. The outage affected all 50 states as well as Washington, DC, Puerto Rico, and the US Virgin Islands.

The outage also cut off service to public safety users on the First Responder Network Authority (FirstNet), the FCC report said. “Voice and 5G data services were also unavailable to users from mobile virtual network operators (MVNOs) and other wireless customers who were roaming on AT&T Mobility’s network,” the FCC said.

An incorrect process

AT&T previously acknowledged that the mobile outage was caused by a botched update related to a network expansion. The “outage was caused by the application and execution of an incorrect process used as we were expanding our network, not a cyber attack,” AT&T said.

The FCC report said the nationwide outage began three minutes after “AT&T Mobility implemented a network change with an equipment configuration error.” This configuration error caused the AT&T network “to enter ‘protect mode’ to prevent impact to other services, disconnecting all devices from the network, and prompting a loss of voice and 5G data service for all wireless users.”

While the network change was rolled back within two hours, full service restoration “took at least 12 hours because AT&T Mobility’s device registration systems were overwhelmed with the high volume of requests for re-registration onto the network,” the FCC found.

Outage reveals deeper problems at AT&T

Although a configuration error was the immediate cause of the outage, the FCC investigation revealed various problems in AT&T’s processes that increased the likelihood of an outage and made recovery more difficult than it should have been. The FCC Public Safety and Homeland Security Bureau analyzed network outage reports and written responses submitted by AT&T and interviewed AT&T employees. The bureau’s report said:

The Bureau finds that the extensive scope and duration of this outage was the result of several factors, all attributable to AT&T Mobility, including a configuration error, a lack of adherence to AT&T Mobility’s internal procedures, a lack of peer review, a failure to adequately test after installation, inadequate laboratory testing, insufficient safeguards and controls to ensure approval of changes affecting the core network, a lack of controls to mitigate the effects of the outage once it began, and a variety of system issues that prolonged the outage once the configuration error had been remedied.

At 2: 42 am CST on February 22, an AT&T “employee placed a new network element into its production network during a routine night maintenance window in order to expand network functionality and capacity,” the FCC said. The configuration “did not conform to AT&T’s established network element design and installment procedures, which require peer review.”

An adequate peer review should have prevented the network change from being approved and from being loaded onto the network, but this peer review did not take place, the FCC said. The configuration error was made by one employee, and the misconfigured network element was loaded onto the network by a second employee.

“The fact that the network change was loaded onto the AT&T Mobility network indicates that AT&T Mobility had insufficient oversight and controls in place to ensure that approval had occurred prior to loading,” the FCC said.

AT&T faces possible punishment

AT&T issued a statement saying it has “implemented changes to prevent what happened in February from occurring again. We fell short of the standards that we hold ourselves to, and we regret that we failed to meet the expectations of our customers and the public safety community.”

AT&T could eventually face some kind of punishment. The Public Safety and Homeland Security Bureau referred the matter to the FCC Enforcement Bureau for potential violations of FCC rules.

Verizon Wireless last month agreed to pay a $1,050,000 fine and implement a compliance plan because of a December 2022 outage in six states that lasted one hour and 44 minutes. The Verizon outage was similarly caused by a botched update, and the FCC investigation revealed systemic problems that made the company prone to such outages.

AT&T failed to test disastrous update that kicked all devices off network Read More »