Policy – Page 26

Meta risks sanctions over “sneaky” ad-free plans confusing users, EU says

consumer protection laws, Digital Markets Act, Digital Services Act, European Commission, European Union, facebook, General Data Protection Regulation, Instagram, Meta, Online Privacy, Policy / Rejus Almole / July 22, 2024

Under pressure —

Consumer laws may change Meta’s ad-free plans before EU’s digital crackdown does.

Ashley Belanger – Jul 22, 2024 7: 37 pm UTC

The European Commission (EC) has finally taken action to block Meta’s heavily criticized plan to charge a subscription fee to users who value privacy on its platforms.

Surprisingly, this step wasn’t taken under laws like the Digital Services Act (DSA), the Digital Markets Act (DMA), or the General Data Protection Regulation (GDPR).

Instead, the EC announced Monday that Meta risked sanctions under EU consumer laws if it could not resolve key concerns about Meta’s so-called “pay or consent” model.

Meta’s model is seemingly problematic, the commission said, because Meta “requested consumers overnight to either subscribe to use Facebook and Instagram against a fee or to consent to Meta’s use of their personal data to be shown personalized ads, allowing Meta to make revenue out of it.”

Because users were given such short notice, they may have been “exposed to undue pressure to choose rapidly between the two models, fearing that they would instantly lose access to their accounts and their network of contacts,” the EC said.

To protect consumers, the EC joined national consumer protection authorities, sending a letter to Meta requiring the tech giant to propose solutions to resolve the commission’s biggest concerns by September 1.

That Meta’s “pay or consent” model may be “misleading” is a top concern because it uses the term “free” for ad-based plans, even though Meta “can make revenue from using their personal data to show them personalized ads.” It seems that while Meta does not consider giving away personal information to be a cost to users, the EC’s commissioner for justice, Didier Reynders, apparently does.

“Consumers must not be lured into believing that they would either pay and not be shown any ads anymore, or receive a service for free, when, instead, they would agree that the company used their personal data to make revenue with ads,” Reynders said. “EU consumer protection law is clear in this respect. Traders must inform consumers upfront and in a fully transparent manner on how they use their personal data. This is a fundamental right that we will protect.”

Additionally, the EC is concerned that Meta users might be confused about how “to navigate through different screens in the Facebook/Instagram app or web-version and to click on hyperlinks directing them to different parts of the Terms of Service or Privacy Policy to find out how their preferences, personal data, and user-generated data will be used by Meta to show them personalized ads.” They may also find Meta’s “imprecise terms and language” confusing, such as Meta referring to “your info” instead of clearly referring to consumers’ “personal data.”

To resolve the EC’s concerns, Meta may have to give EU users more time to decide if they want to pay to subscribe or consent to personal data collection for targeted ads. Or Meta may have to take more drastic steps by altering language and screens used when securing consent to collect data or potentially even scrapping its “pay or consent” model entirely, as pressure in the EU mounts.

So far, Meta has defended its model against claims that it violates the DMA, the DSA, and the GDPR, and Meta’s spokesperson told Ars that Meta continues to defend the model while facing down the EC’s latest action.

“Subscriptions as an alternative to advertising are a well-established business model across many industries,” Meta’s spokesperson told Ars. “Subscription for no ads follows the direction of the highest court in Europe and we are confident it complies with European regulation.”

Meta’s model is “sneaky,” EC said

Since last year, the social media company has argued that its “subscription for no ads” model was “endorsed” by the highest court in Europe, the Court of Justice of the European Union (CJEU).

However, privacy advocates have noted that this alleged endorsement came following a CJEU case under the GDPR and was only presented as a hypothetical, rather than a formal part of the ruling, as Meta seems to interpret.

What the CJEU said was that “users must be free to refuse individually”—”in the context of” signing up for services—”to give their consent to particular data processing operations not necessary” for Meta to provide such services “without being obliged to refrain entirely from using the service.” That “means that those users are to be offered, if necessary for an appropriate fee, an equivalent alternative not accompanied by such data processing operations,” the CJEU said.

The nuance here may matter when it comes to Meta’s proposed solutions even if the EC accepts the CJEU’s suggestion of an acceptable alternative as setting some sort of legal precedent. Because the consumer protection authorities raised the action due to Meta suddenly changing the consent model for existing users—not “in the context of” signing up for services—Meta may struggle to persuade the EC that existing users weren’t misled and pressured into paying for a subscription or consenting to ads, given how fast Meta’s policy shifted.

Meta risks sanctions if a compromise can’t be reached, the EC said. Under the EU’s Unfair Contract Terms Directive, for example, Meta could be fined up to 4 percent of its annual turnover if consumer protection authorities are unsatisfied with Meta’s proposed solutions.

The EC’s vice president for values and transparency, Věra Jourová, provided a statement in the press release, calling Meta’s abrupt introduction of the “pay or consent” model “sneaky.”

“We are proud of our strong consumer protection laws which empower Europeans to have the right to be accurately informed about changes such as the one proposed by Meta,” Jourová said. “In the EU, consumers are able to make truly informed choices and we now take action to safeguard this right.”

Meta risks sanctions over “sneaky” ad-free plans confusing users, EU says Read More »

Can the solar industry keep the lights on?

climate change, Policy, solar panels, syndication / Mike M. / July 22, 2024

Image of solar panels on a green grassy field, with blue sky in the background.

Founded in Dresden in the early 1990s, Germany’s Solarwatt quickly became an emblem of Europe’s renewable energy ambitions and bold plan to build a solar power industry.

Its opening of a new solar panel plant in Dresden in late 2021 was hailed as a small victory in the battle to wrestle market share from the Chinese groups that have historically supplied the bulk of panels used in Europe.

Now, Solarwatt is preparing to halt production at the plant and shift that work to China.

“It is a big pity for our employees, but from an economic point of view we could not do otherwise,” said Peter Bachmann, the company’s chief product officer.

Solarwatt is not alone. A global supply glut has pummelled solar panel prices over the past two years, leaving swaths of Europe’s manufacturers unprofitable, threatening US President Joe Biden’s ambition to turn America into a renewable energy force and even ricocheting back on the Chinese companies that dominate the global market.

“We are in a crisis,” said Johan Lindahl, secretary-general of the European Solar Manufacturing Council, the European industry’s trade body.

Yet as companies in Europe, the US, and China cut jobs, delay projects, and mothball facilities, an abundance of cheap solar panels has delivered one significant upside—consumers and businesses are installing them in ever greater numbers.

Electricity generated from solar power is expected to surpass that of wind and nuclear by 2028, according to the International Energy Agency.

The picture underlines the quandary confronting governments that have pledged to decarbonise their economies, but will find doing so harder unless the historic shift from fossil fuels is both affordable for the public and creates new jobs.

Governments face a “delicate and difficult balancing act,” said Michael Parr, director of trade group Ultra Low Carbon Solar Alliance. They must “maximize renewables deployment and carbon reductions, bolster domestic manufacturing sectors, keep energy prices low, and ensure energy security.”

The industry, which spans wafer, cell, and panel manufacturers, as well as companies that install panels, employed more than 800,000 people in Europe at the end of last year, according to SolarPower Europe. In the US almost 265,000 work in the sector, figures from the Interstate Renewable Energy Council show.

“There is overcapacity in every segment, starting with polysilicon and finishing with the module,” said Yana Hryshko, head of global solar supply chain research at the consultancy Wood Mackenzie.

According to BloombergNEF, panel prices have plunged more than 60 percent since July 2022. The scale of the damage inflicted has sparked calls for Brussels to protect European companies from what the industry says are state-subsidized Chinese products.

Europe’s solar panel manufacturing capacity has collapsed by about half to 3 gigawatts since November as companies have failed, mothballed facilities, or shifted production abroad, the European Solar Manufacturing Council estimates. In rough terms, a gigawatt can potentially supply electricity for 1mn homes.

The hollowing out comes as the EU is banking on solar power playing a major role in the bloc meeting its target of generating 45 percent of its energy from renewable sources by 2030. In the US, the Biden administration has set a target of achieving a 100 percent carbon pollution-free electricity grid by 2035.

Climate change is a global challenge, but executives said the solar industry’s predicament exposed how attempts to address it can quickly fracture along national and regional lines.

“There’s trade policy and then there’s climate policy, and they aren’t in sync,” said Andres Gluski, chief executive of AES, one of the world’s biggest developers of clean energy. “That’s a problem.”

Brussels has so far resisted demands to impose tariffs. It first levied them in 2012 but reversed that in 2018, partly in what proved a successful attempt to quicken the uptake of solar. Chinese imports now account for the lion’s share of Europe’s solar panels.

In May, the European Commission introduced the Net Zero Industry Act, legislation aimed at bolstering the bloc’s clean energy industries by cutting red tape and promoting a regional supply chain.

But Gunter Erfurt, chief executive of Switzerland-based Meyer Burger, the country’s largest solar panel maker, is skeptical it will be enough.

“You need to create a level playing field,” he said. Meyer Burger would benefit if the EU imposed tariffs because it has operations in Germany.

Can the solar industry keep the lights on? Read More »

Apple “clearly underreporting” child sex abuse, watchdogs say

Apple, child sex abuse, child sexual abuse materials, csam, FaceTime, iCloud, iMessage, online child safety, Policy, united kingdom / Kris Guyer / July 22, 2024

After years of controversies over plans to scan iCloud to find more child sexual abuse materials (CSAM), Apple abandoned those plans last year. Now, child safety experts have accused the tech giant of not only failing to flag CSAM exchanged and stored on its services—including iCloud, iMessage, and FaceTime—but also allegedly failing to report all the CSAM that is flagged.

The United Kingdom’s National Society for the Prevention of Cruelty to Children (NSPCC) shared UK police data with The Guardian showing that Apple is “vastly undercounting how often” CSAM is found globally on its services.

According to the NSPCC, police investigated more CSAM cases in just the UK alone in 2023 than Apple reported globally for the entire year. Between April 2022 and March 2023 in England and Wales, the NSPCC found, “Apple was implicated in 337 recorded offenses of child abuse images.” But in 2023, Apple only reported 267 instances of CSAM to the National Center for Missing & Exploited Children (NCMEC), supposedly representing all the CSAM on its platforms worldwide, The Guardian reported.

Large tech companies in the US must report CSAM to NCMEC when it’s found, but while Apple reports a couple hundred CSAM cases annually, its big tech peers like Meta and Google report millions, NCMEC’s report showed. Experts told The Guardian that there’s ongoing concern that Apple “clearly” undercounts CSAM on its platforms.

Richard Collard, the NSPCC’s head of child safety online policy, told The Guardian that he believes Apple’s child safety efforts need major improvements.

“There is a concerning discrepancy between the number of UK child abuse image crimes taking place on Apple’s services and the almost negligible number of global reports of abuse content they make to authorities,” Collard told The Guardian. “Apple is clearly behind many of their peers in tackling child sexual abuse when all tech firms should be investing in safety and preparing for the rollout of the Online Safety Act in the UK.”

Outside the UK, other child safety experts shared Collard’s concerns. Sarah Gardner, the CEO of a Los Angeles-based child protection organization called the Heat Initiative, told The Guardian that she considers Apple’s platforms a “black hole” obscuring CSAM. And she expects that Apple’s efforts to bring AI to its platforms will intensify the problem, potentially making it easier to spread AI-generated CSAM in an environment where sexual predators may expect less enforcement.

“Apple does not detect CSAM in the majority of its environments at scale, at all,” Gardner told The Guardian.

Gardner agreed with Collard that Apple is “clearly underreporting” and has “not invested in trust and safety teams to be able to handle this” as it rushes to bring sophisticated AI features to its platforms. Last month, Apple integrated ChatGPT into Siri, iOS and Mac OS, perhaps setting expectations for continually enhanced generative AI features to be touted in future Apple gear.

“The company is moving ahead to a territory that we know could be incredibly detrimental and dangerous to children without the track record of being able to handle it,” Gardner told The Guardian.

So far, Apple has not commented on the NSPCC’s report. Last September, Apple did respond to the Heat Initiative’s demands to detect more CSAM, saying that rather than focusing on scanning for illegal content, its focus is on connecting vulnerable or victimized users directly with local resources and law enforcement that can assist them in their communities.

Apple “clearly underreporting” child sex abuse, watchdogs say Read More »

FCC blasts T-Mobile’s 365-day phone locking, proposes 60-day unlock rule

phone unlocking, Policy, T-Mobile / Mike M. / July 19, 2024

Getty Images | SOPA Images

Citing frustration with mobile carriers enforcing different phone-unlocking policies that are bad for consumers, the Federal Communications Commission is proposing a 60-day unlocking requirement that would apply to all wireless providers.

The industry’s “confusing and disparate cell phone unlocking policies” mean that “some consumers can unlock their phones with relative ease, while others face significant barriers,” Commissioner Geoffrey Starks said at yesterday’s FCC meeting. “It also means certain carriers are subject to mandatory unlocking requirements while others are free to dictate their own. This asymmetry is bad for both consumers and competition.”

The FCC is “proposing a uniform 60-day unlocking policy” so that “consumers can choose the carrier that offers them the best value,” Starks said. Unlocking a phone allows it to be used on a different carrier’s network as long as the phone is compatible.

The FCC approved the Notice of Proposed Rulemaking (NPRM) in a 5-0 vote. That begins a public comment period that could lead to a final rulemaking. A draft of the NPRM said the FCC “propose[s] to require all mobile wireless service providers to unlock handsets 60 days after a consumer’s handset is activated with the provider, unless within the 60-day period the service provider determines the handset was purchased through fraud.”

T-Mobile prepaid imposes 365-day lock

FCC Chairwoman Jessica Rosenworcel said that unlocking requirements have been imposed by the FCC in spectrum auctions and by the Department of Justice as a merger condition, but “restrictions on consumers unlocking their phones have persisted.”

“You bought your phone, you should be able to take it to any provider you want,” Rosenworcel said. “Some providers already operate this way. Others do not. In fact, some have recently increased the time their customers must wait until they can unlock their device by as much as 100 percent.”

Rosenworcel apparently was referring to a prepaid brand offered by T-Mobile. The NPRM draft said that “T-Mobile recently increased its locking period for one of its brands, Metro by T-Mobile, from 180 days to 365 days.” The 365-day rule brought Metro into line with other T-Mobile prepaid phones that already came with the year-long lock. We reached out to T-Mobile and will update this article if it provides a comment.

A merger condition imposed on T-Mobile’s purchase of Sprint merely requires that it unlock prepaid phones within one year. T-Mobile imposes different unlocking policies on prepaid and postpaid phones. For postpaid devices, T-Mobile says it will unlock phones that have been active for at least 40 days, but only if any associated financing or leasing agreement has been paid in full.

Exactly how the FCC’s proposed rules will apply to phones that haven’t been paid off is to be determined. The FCC will “seek comment on how our proposal might affect the incentive and ability of wireless providers to continue offering discounts on handsets, particularly in connection with extended payment plans, and lower prices on plans with minimum term commitments.”

One question asked in the draft NPRM suggests the FCC could require unlocking once a consumer with a device payment plan has made the first payment. The FCC asked:

Alternatively, should we require service providers to unlock handsets after a period shorter or longer than 60 days? For example, should we require all handsets to be unlocked by default upon activation? Or, should we require all handsets to be unlocked after the end of the handset’s return period or after the first payment on the handset has been processed? Would a standardized time period of a certain number of days be easier to implement and enforce than non-standardized time periods based on return periods or billing cycles? What is the minimum amount of time service providers need to protect themselves from handset fraud? Rather than locking handsets, are there other ways service providers can protect themselves from handset fraud that would allow the Commission to prohibit the locking of handsets altogether?

FCC blasts T-Mobile’s 365-day phone locking, proposes 60-day unlock rule Read More »

Elon Musk’s X tests letting users request Community Notes on bad posts

AI, Artificial Intelligence, chatbot, community notes, disinformation, elon musk, fact checking, grok, misinformation, online news, Policy, Twitter, X / Kris Guyer / July 19, 2024

Continuing to evolve the fact-checking service that launched as Twitter’s Birdwatch, X has announced that Community Notes can now be requested to clarify problematic posts spreading on Elon Musk’s platform.

X’s Community Notes account confirmed late Thursday that, due to “popular demand,” X had launched a pilot test on the web-based version of the platform. The test is active now and the same functionality will be “coming soon” to Android and iOS, the Community Notes account said.

Through the current web-based pilot, if you’re an eligible user, you can click on the “•••” menu on any X post on the web and request fact-checking from one of Community Notes’ top contributors, X explained. If X receives five or more requests within 24 hours of the post going live, a Community Note will be added.

Only X users with verified phone numbers will be eligible to request Community Notes, X said, and to start, users will be limited to five requests a day.

“The limit may increase if requests successfully result in helpful notes, or may decrease if requests are on posts that people don’t agree need a note,” X’s website said. “This helps prevent spam and keep note writers focused on posts that could use helpful notes.”

Once X receives five or more requests for a Community Note within a single day, top contributors with diverse views will be alerted to respond. On X, top contributors are constantly changing, as their notes are voted as either helpful or not. If at least 4 percent of their notes are rated “helpful,” X explained on its site, and the impact of their notes meets X standards, they can be eligible to receive alerts.

“A contributor’s Top Writer status can always change as their notes are rated by others,” X’s website said.

Ultimately, X considers notes helpful if they “contain accurate, high-quality information” and “help inform people’s understanding of the subject matter in posts,” X said on another part of its site. To gauge the former, X said that the platform partners with “professional reviewers” from the Associated Press and Reuters. X also continually monitors whether notes marked helpful by top writers match what general X users marked as helpful.

“We don’t expect all notes to be perceived as helpful by all people all the time,” X’s website said. “Instead, the goal is to ensure that on average notes that earn the status of Helpful are likely to be seen as helpful by a wide range of people from different points of view, and not only be seen as helpful by people from one viewpoint.”

X will also be allowing half of the top contributors to request notes during the pilot phase, which X said will help the platform evaluate “whether it is beneficial for Community Notes contributors to have both the ability to write notes and request notes.”

According to X, the criteria for requesting a note have intentionally been designed to be simple during the pilot stage, but X expects “these criteria to evolve, with the goal that requests are frequently found valuable to contributors, and not noisy.”

It’s hard to tell from the outside looking in how helpful Community Notes are to X users. The most recent Community Notes survey data that X points to is from 2022 when the platform was still called Twitter and the fact-checking service was still called Birdwatch.

That data showed that “on average,” users were “20–40 percent less likely to agree with the substance of a potentially misleading Tweet than someone who sees the Tweet alone.” And based on Twitter’s “internal data” at that time, the platform also estimated that “people on Twitter who see notes are, on average, 15–35 percent less likely to Like or Retweet a Tweet than someone who sees the Tweet alone.”

Elon Musk’s X tests letting users request Community Notes on bad posts Read More »

Elon Musk’s X may succeed in blocking Calif. content moderation law on appeal

California, content moderation, elon musk, First Amendment, free speech rights, Online speech, Policy, Twitter, X, x corp / Mike M. / July 18, 2024

Judgment call —

Elon Musk’s X previously failed to block the law on First Amendment grounds.

Ashley Belanger – Jul 18, 2024 8: 17 pm UTC

Elon Musk’s fight defending X’s content moderation decisions isn’t just with hate speech researchers and advertisers. He has also long been battling regulators, and this week, he seemed positioned to secure a potentially big win in California, where he’s hoping to permanently block a law that he claims unconstitutionally forces his platform to justify its judgment calls.

At a hearing Wednesday, three judges in the 9th US Circuit Court of Appeals seemed inclined to agree with Musk that a California law requiring disclosures from social media companies that clearly explain their content moderation choices likely violates the First Amendment.

Passed in 2022, AB-587 forces platforms like X to submit a “terms of service report” detailing how they moderate several categories of controversial content. Those categories include hate speech or racism, extremism or radicalization, disinformation or misinformation, harassment, and foreign political interference, which X’s lawyer, Joel Kurtzberg, told judges yesterday “are the most controversial categories of so-called awful but lawful speech.”

The law would seemingly require more transparency than ever from X, making it easy for users to track exactly how much controversial content X flags and removes—and perhaps most notably for advertisers, how many users viewed concerning content.

To block the law, X sued in 2023, arguing that California was trying to dictate its terms of service and force the company to make statements on content moderation that could generate backlash. X worried that the law “impermissibly” interfered with both “the constitutionally protected editorial judgments” of social media companies, as well as impacted users’ speech by requiring companies “to remove, demonetize, or deprioritize constitutionally protected speech that the state deems undesirable or harmful.”

Any companies found to be non-compliant could face stiff fines of up to $15,000 per violation per day, which X considered “draconian.” But last year, a lower court declined to block the law, prompting X to appeal, and yesterday, the appeals court seemed more sympathetic to X’s case.

At the hearing, Kurtzberg told judges that the law was “deeply threatening to the well-established First Amendment interests” of an “extraordinary diversity of” people, which is why X’s complaint was supported by briefs from reporters, freedom of the press advocates, First Amendment scholars, “conservative entities,” and people across the political spectrum.

All share “a deep concern about a statute that, on its face, is aimed at pressuring social media companies to change their content moderation policies, so as to carry less or even no expression that’s viewed by the state as injurious to its people,” Kurtzberg told judges.

When the court pointed out that seemingly the law simply required X to abide by content moderation policies for each category defined in its own terms of service—and did not compel X to adopt any policy or position that it did not choose—Kurtzberg pushed back.

“They don’t mandate us to define the categories in a specific way, but they mandate us to take a position on what the legislature makes clear are the most controversial categories to moderate and define,” Kurtzberg said. “We are entitled to respond to the statute by saying we don’t define hate speech or racism. But the report also asks about policies that are supposedly, quote, ‘intended’ to address those categories, which is a judgment call.”

“This is very helpful,” Judge Anthony Johnstone responded. “Even if you don’t yourself define those categories in the terms of service, you read the law as requiring you to opine or discuss those categories, even if they’re not part of your own terms,” and “you are required to tell California essentially your views on hate speech, extremism, harassment, foreign political interference, how you define them or don’t define them, and what you choose to do about them?”

“That is correct,” Kurtzberg responded, noting that X considered those categories the most “fraught” and “difficult to define.”

Elon Musk’s X may succeed in blocking Calif. content moderation law on appeal Read More »

FCC closes “final loopholes” that keep prison phone prices exorbitantly high

Policy, prison phone prices / Paul Patrick / July 18, 2024

A telephone on a wall inside a prison. — Enlarge / A telephone in a prison.

The Federal Communications Commission today voted to lower price caps on prison phone calls and closed a loophole that allowed prison telecoms to charge high rates for intrastate calls. Today’s vote will cut the price of interstate calls in half and set price caps on intrastate calls for the first time.

The FCC said it “voted to end exorbitant phone and video call rates that have burdened incarcerated people and their families for decades. Under the new rules, the cost of a 15-minute phone call will drop to $0.90 from as much as $11.35 in large jails and, in small jails, to $1.35 from $12.10.”

The new rules are expected to take effect in January 2025 for all prisons and for jails with at least 1,000 incarcerated people. The rate caps would take effect in smaller jails in April 2025.

Worth Rises, a nonprofit group advocating for prison reform, said it “estimates that the new rules will impact 83 percent of incarcerated people (about 1.4 million) and save impacted families at least $500 million annually.”

New power over intrastate calls

The FCC has taken numerous votes to lower prison phone rates over the years, but today’s is particularly significant. While the FCC was previously able to cap prices of interstate calls, an attempt to set prices for intrastate calls was struck down in court in 2017.

Prison phone companies could sue again. But the FCC said it now has authority over intrastate prison phone prices because of the Martha Wright-Reed Just and Reasonable Communications Act, which was approved by Congress and signed by President Biden in January 2023. The new law “empowered the FCC to close the final loopholes in the communications system,” the commission said.

The 2023 law—named for a grandmother who campaigned for lower prison phone rates—”removes the principal statutory limitations that had prevented the Commission from setting comprehensive just and reasonable rates,” the FCC said. Specifically, the law removed “limits to the Commission’s ability to regulate rates for intrastate calls and video communications.”

More than half of prison audio call traffic is intrastate, with the calling and called parties both in the same state, according to data in a draft of the FCC order released before the meeting.

The FCC’s work to reduce prison phone rates “was not always embraced by the courts,” Chairwoman Jessica Rosenworcel said today. “We were told—over and over again—that the commission did not have the authority to address every aspect of these rates, because while interstate calls fell within our jurisdiction, intrastate calls did not.”

Previously, the FCC imposed price caps on interstate calls ranging from $0.14 to $0.21 per minute for audio calls, depending on the size of the facility. Going forward, a uniform set of price caps ranging from $0.06 to $0.12 per minute will apply to both interstate and intrastate calls.

FCC closes “final loopholes” that keep prison phone prices exorbitantly high Read More »

After breach, senators ask why AT&T stores call records on “AI Data Cloud”

at&t data breach, Policy, snowflake breach / Rejus Almole / July 17, 2024

US senators want AT&T to explain why it stores massive amounts of call and text message records on a third-party analytics platform that bills itself as an “AI Data Cloud.”

AT&T revealed last week that “customer data was illegally downloaded from our workspace on a third-party cloud platform,” and that the breach “includes files containing AT&T records of calls and texts of nearly all of AT&T’s cellular customers.” The third-party platform is Snowflake, and AT&T is one of many Snowflake corporate customers that had data stolen. Ticketmaster is another notable company affected by the breach.

AT&T and Snowflake each got letters yesterday from US Sens. Richard Blumenthal (D-Conn.) and Josh Hawley (R-Mo.), the chair and ranking member of the Senate Judiciary Subcommittee on Privacy, Technology, and the Law. The senators asked AT&T CEO John Stankey to answer a series of questions, including this one:

Why had AT&T retained months of detailed records of customer communication for an extended amount of time and why had AT&T uploaded that sensitive information onto a third party analytics platform? What is AT&T policy, including timelines, concerning retaining and using such information?

AT&T’s disclosures to customers and to the Securities and Exchange Commission didn’t explain how Snowflake is used by AT&T. Snowflake’s website says the company’s cloud platform provides opportunities for collaborating and sharing data:

Powering the AI Data Cloud is Snowflake’s single platform. Its unique architecture connects businesses globally, at practically any scale to bring data and workloads together. Together with the Snowflake Marketplace which simplifies the sharing, collaborating, and monetizing of thousands of datasets, services, and entire data applications—this creates the active and growing AI Data Cloud.

AT&T a featured customer

There was already a public explanation for why AT&T uses Snowflake, but it’s written in marketing speak and isn’t likely to directly answer the senators’ questions. Sometime before the hacks, Snowflake posted a glowing case study on how AT&T lowered costs and gained “faster insights” by switching from internal systems to Snowflake.

Snowflake says it provides a telecom-focused AI Data Cloud service that helps firms like AT&T “improve customer experiences, maximize operational efficiency and increase profitability by reducing costs and monetizing new data products.” AT&T’s decision to move data to Snowflake apparently allowed it to abandon “complex on-premises systems, including Hadoop” that “were slowing down business.”

“The Snowflake Data Cloud has given us the power to harness and integrate data to create insights,” AT&T Chief Data Officer Andy Markus is quoted as saying in the promotional material. “With data at our fingertips, we are growing revenue, becoming more cost effective and, most importantly, improving the customer experience.”

Markus said the previous internal system made it hard to collaborate with other companies. “Prior to Snowflake, we had a very complex data environment on-premises,” Markus said. “That led to a more ineffective operating environment for our business partners, both from a speed and cost perspective.”

With Snowflake, AT&T is said to have “a powerful, easy-to-use data management system that efficiently processes hundreds of petabytes of data every day.” This makes it easier to share data.

“Using Hadoop for storage and processing, AT&T’s monolithic on-premises data warehouse hampered the team from collecting, storing, sharing and processing its vast stores of data,” the customer case study said. “By moving to the Snowflake Telecom Data Cloud, Markus and his team achieved their goal of democratizing data across the business.”

Snowflake boasted that because of its cloud platform, “this leading telecom provider uses data to advance innovation, create new revenue streams, optimize operations and, most importantly, better connect people to their world.”

AT&T said it uses “trusted” cloud providers

When contacted by Ars today, AT&T provided a statement in response to the senators’ questions about its use of Snowflake. “Like most companies that deal with large amounts of data, AT&T often uses specialized and trusted cloud services platforms for various functions. These platforms enable companies to work with large amounts of data in a centralized place. In this case, AT&T had put a copy of the data on the third-party platform for analysis related to our business,” AT&T told us.

AT&T added that it “analyzes historical customer data for uses that include network planning, capacity utilization, and developing new services and offers.”

AT&T did not provide specifics on how long it retains data. “We set our data retention periods depending on the type of personal information, how long it is needed to operate the business or provide our products and services, and whether it is subject to contractual or legal obligations. These obligations might be ongoing litigation, mandatory data retention laws, or government orders to preserve data for an investigation,” the company said today.

We also asked Snowflake for details on exactly how phone companies use its platform. A Snowflake spokesperson did not answer our question but told us that the company will respond directly to the senators.

After breach, senators ask why AT&T stores call records on “AI Data Cloud” Read More »

Meta tells court it won’t sue over Facebook feed-killing tool—yet

data protection, facebook, First Amendment, Meta, Online Privacy, Policy, Section 230, unfollow everything, user privacy / Mike M. / July 17, 2024

This week, Meta asked a US district court in California to toss a lawsuit filed by a professor, Ethan Zuckerman, who fears that Meta will sue him if he releases a tool that would give Facebook users an automated way to easily remove all content from their feeds.

Zuckerman has alleged that the imminent threat of a lawsuit from Meta has prevented him from releasing Unfollow Everything 2.0, suggesting that a cease-and-desist letter sent to the creator of the original Unfollow Everything substantiates his fears.

He’s hoping the court will find that either releasing his tool would not breach Facebook’s terms of use—which prevent “accessing or collecting data from Facebook ‘using automated means'”—or that those terms conflict with public policy. Among laws that Facebook’s terms allegedly conflict with are the First Amendment, section 230 of the Communications Decency Act, the Computer Fraud and Abuse Act (CFAA), as well as California’s Computer Data Access and Fraud Act (CDAFA) and state privacy laws.

But Meta claimed in its motion to dismiss that Zuckerman’s suit is too premature, mostly because the tool has not yet been built and Meta has not had a chance to review the “non-existent tool” to determine how Unfollow Everything 2.0 might impact its platform or its users.

“Besides bald assertions about how Plaintiff intends Unfollow Everything 2.0 to work and what he plans to do with it, there are no concrete facts that would enable this Court to adjudicate potential legal claims regarding this tool—which, at present, does not even operate in the real world,” Meta argued.

Meta wants all of Zuckerman’s claims to be dismissed, arguing that “adjudicating Plaintiff’s claims would require needless rulings on hypothetical applications of California law, would likely result in duplicative litigation, and would encourage forum shopping.”

At the heart of Meta’s defense is a claim that there’s no telling yet if Zuckerman will ever be able to release the tool, although Zuckerman said he was prepared to finish the build within six weeks of a court win. Last May, Zuckerman told Ars that because Facebook’s functionality could change while the lawsuit is settled, it’s better to wait to finish building the tool because Facebook’s design is always changing.

Meta claimed that Zuckerman can’t confirm if Unfollow Everything 2.0 would work as described in his suit precisely because his findings are based on Facebook’s current interface, and the “process for unfollowing has changed over time and will likely continue to change.”

Further, Meta argued that the original Unfollow Everything performed in a different way—by logging in on behalf of users and automatically unfollowing everything, rather than performing the automated unfollowing when the users themselves log in. Because of that, Meta argued that the new tool may not prompt the same response from Meta.

A senior staff attorney at the Knight Institute who helped draft Zuckerman’s complaint, Ramya Krishnan, told Ars that the two tools operate nearly identically, however.

“Professor Zuckerman’s tool and the original Unfollow Everything work in essentially the same way,” Krishnan told Ars. “They automatically unfollow all of a user’s friends, groups, and pages after the user installs the tool and logs in to Facebook using their web browser.”

Ultimately, Meta claimed that there’s no telling if Meta would even sue over the tool’s automated access to user data, dismissing Zuckerman’s fears as unsubstantiated.

Only when the tool is out in the wild and Facebook is able to determine “actual, concrete facts about how it works in practice” that “may prove problematic” will Meta know if a legal response is needed, Meta claimed. Without reviewing the technical specs, Meta argued, Meta has no way to assess the damages or know if it would sue over a breach of contract, as alleged, or perhaps over other claims not alleged, such as trademark infringement.

Meta tells court it won’t sue over Facebook feed-killing tool—yet Read More »

Craig Wright’s claim of inventing bitcoin may get him arrested for perjury

craig wright bitcoin, Policy / Kris Guyer / July 16, 2024

Not the real Satoshi —

UK judge refers Wright to prosecutors, suggests arrest warrant and extradition.

Jon Brodkin – Jul 16, 2024 6: 58 pm UTC

Craig Wright walking on the street, wearing a suit and tie. — Enlarge / Dr. Craig Wright arrives at the Rolls Building, part of the Royal Courts of Justice, on February 6, 2024, in London, England.

A British judge is referring self-proclaimed bitcoin inventor Craig Wright to the Crown Prosecution Service (CPS) to consider criminal charges of perjury and forgery. The judge said that CPS can decide whether Wright should be arrested and granted two injunctions that prohibit Wright from re-litigating his claim to be bitcoin inventor Satoshi Nakamoto.

“I have no doubt that I should refer the relevant papers in this case to the CPS for consideration of whether a prosecution should be commenced against Dr. Wright for his wholescale perjury and forgery of documents and/or whether a warrant for his arrest should be issued and/or whether his extradition should be sought from wherever he now is. All those matters are to be decided by the CPS,” Justice James Mellor of England’s High Court of Justice wrote in a ruling issued today.

If Wright actually believes he is Nakamoto, “he is deluding himself,” Mellor wrote.

Mellor previously found that Wright “lied repeatedly and extensively” and forged documents “on a grand scale” in a case related to Wright’s claim that he is Nakamoto. The case began when Wright was sued by the nonprofit Crypto Open Patent Alliance (COPA), which said its goal was to disprove Wright’s bitcoin-inventing claim and stop him from claiming intellectual property rights to the system.

Wright’s location unknown

Wright’s location is unknown, today’s ruling said. “The evidence shows that Dr. Wright has left his previous residence in Wimbledon, appears to have left the UK, has been said to be traveling and was last established to be in the time zone of UTC +7,” Mellor wrote.

COPA asked Mellor “to dispense with personal service of the final Order on Dr. Wright” because his whereabouts are a mystery. COPA told the court that “Dr. Wright may either be deliberately evading service or at least is peripatetic and is very difficult to locate.” Mellor wrote that COPA’s view “seems to me to be fully justified and warrants the order which COPA seeks as to service of my final Order on Dr. Wright at his solicitors.”

After the events of the trial, Mellor’s decision to refer Wright for a perjury prosecution was apparently an easy one. “As COPA submitted, if what happened in this case does not warrant referral to the CPS, it is difficult to envisage a case which would… In advancing his false claim to be Satoshi through multiple legal actions, Dr. Wright committed ‘a most serious abuse’ of the process of the courts of the UK, Norway and the USA,” Mellor wrote.

Anti-lawsuit injunction

Mellor also approved COPA’s request for injunctions that prohibit Wright from bringing certain kinds of lawsuits based on his bitcoin-inventing claim. As the Associated Press reported, the approved injunctions are intended to prevent Wright “from threatening to sue or filing lawsuits aimed at developers.”

The COPA requests approved by Mellor were for “an anti-suit injunction preventing Dr. Wright or the other Claimants in the related claims from pursuing further proceedings in this or other jurisdictions to re-litigate his claim to be Satoshi,” and “a related order preventing him from threatening such proceedings.”

Mellor declined to issue additional orders preventing Wright from asserting legal rights as Nakamoto, preventing re-publication of Wright’s fraudulent claims, and requiring him to delete previously published statements. The judge said there was some overlap between the injunction requests that were approved and those that were not. Moreover, Wright would have difficulty convincing anyone that he invented bitcoin without violating the two approved injunctions.

Although there is a slight risk that “certain people may start to change their minds or begin to believe that Dr. Wright is Satoshi… I am inclined to the view that the effect would be small. Right-thinking people are likely to regard those assertions as hot air or empty rhetoric, even faintly ridiculous,” Mellor wrote.

Similarly, an order to delete statements “would be disproportionate” and is unnecessary because “anyone with an interest in Bitcoin will have been aware of the COPA Trial and know of the outcome,” Mellor wrote. However, the judge decided that COPA can make the requests again if it turns out to be necessary.

“I accept that my assessment may turn out to be off the mark. Furthermore, the evidence shows that whilst Dr. Wright has modified his public statements following the outcome of the COPA Trial, that may well turn out to be temporary. Dr. Wright is perfectly capable, once the dust has settled, of ramping up his public pronouncements again,” Mellor wrote.

Because of that possibility, Mellor said COPA has “permission to apply, for a period of 2 years, for any further injunctive relief they consider they can establish to be required to protect the interests of the corporate entities they represent as well as the individuals in the Bitcoin community who have suffered due to Dr. Wright’s false claim to be Satoshi.”

Craig Wright’s claim of inventing bitcoin may get him arrested for perjury Read More »

Google’s $500M effort to wreck Microsoft EU cloud deal failed, report says

Amazon, Antitrust law, cloud infrastructure, cloud market, cloud service providers, European Union, Google, microsoft, Policy / Kris Guyer / July 16, 2024

Google tried to derail a Microsoft antitrust settlement over anticompetitive software licensing in the European Union by offering a $500 million alternative deal to the group of cloud providers behind the EU complaint, Bloomberg reported.

According to Bloomberg, Google’s offer to the Cloud Infrastructure Services Providers in Europe (CISPE) required that the group maintain its EU antitrust complaint. It came “just days” before CISPE settled with Microsoft, and it was apparently not compelling enough to stop CISPE from inking a deal with the software giant that TechCrunch noted forced CISPE to accept several compromises.

Bloomberg uncovered Google’s attempted counteroffer after reviewing confidential documents and speaking to “people familiar with the matter.” Apparently, Google sought to sway CISPE with a package worth nearly $500 million for more than five years of software licenses and about $15 million in cash.

But CISPE did not take the bait, announcing last week that an agreement was reached with Microsoft, seemingly frustrating Google.

CISPE initially raised its complaint in 2022, alleging that Microsoft was “irreparably damaging the European cloud ecosystem and depriving European customers of choice in their cloud deployments” by spiking costs to run Microsoft’s software on rival cloud services. In February, CISPE said that “any remedies and resolution must apply across the sector and to be accessible to all cloud customers in Europe.” They also promised that “any agreements will be made public.”

But the settlement reached last week excluded major rivals, including Amazon, which is a CISPE member, and Google, which is not. And despite CISPE’s promise, the terms of the deal were not published, apart from a CISPE blog roughly outlining central features that it claimed resolved the group’s concerns over Microsoft’s allegedly anticompetitive behaviors.

What is clear is that CISPE agreed to drop their complaint by taking the deal, but no one knows exactly how much Microsoft paid in a “lump sum” to cover CISPE legal fees for three years, TechCrunch noted. However, “two people with direct knowledge of the matter” told Reuters that Microsoft offered about $22 million.

Google has been trying to catch up with Microsoft and Amazon in the cloud market and has recently begun gaining ground. Last year, Google’s cloud operation broke even for the first time, and the company earned a surprising $900 million in profits in the first quarter of 2024, which bested analysts’ projections by more than $200 million, Bloomberg reported. For Google, the global cloud market has become a key growth area, Bloomberg noted, as potential growth opportunities in search advertising slow. Seemingly increasing regulatory pressure on Microsoft while taking a chunk of its business in the EU was supposed to be one of Google’s next big moves.

A CISPE spokesperson, Ben Maynard, told Ars that its “members were presented with alternative options to accepting the Microsoft deal,” while not disclosing the terms of the other options. “However, the members voted by a significant majority to accept the Microsoft offer, which, in their view, presented the best opportunity for the European cloud sector,” Maynard told Ars.

Neither Microsoft nor Google has commented directly on the reported counteroffer. A Google spokesperson told Bloomberg that Google “has long supported the principles of fair software licensing and that the firm was having discussions about joining CISPE, to fight anticompetitive licensing practices.” A person familiar with the matter told Ars that Google did not necessarily make the counteroffer contingent on dropping the EU complaint, but had long been exploring joining CISPE and would only do so if CISPE upheld its mission to defend fair licensing deals. Microsoft reiterated a past statement from its president, Brad Smith, confirming that Microsoft was “pleased” to resolve CISPE’s antitrust complaint.

For CISPE, the resolution may not have been perfect, but it “will enable European cloud providers to offer Microsoft applications and services on their local cloud infrastructures, meeting the demand for sovereign cloud solutions.” In 2022, CISPE Secretary-General Francisco Mingorance told Ars that although CISPE had been clear that it intended to force Microsoft to make changes allowing all cloud rivals to compete, “a key reason behind filing the complaint was to support” two smaller cloud service providers, Aruba and OVH.

Google’s $500M effort to wreck Microsoft EU cloud deal failed, report says Read More »

Record labels sue Verizon for not disconnecting pirates’ Internet service

music piracy, Policy, verizon / Mike M. / July 15, 2024

Music piracy —

Lawsuit: One user’s IP address was identified in 4,450 infringement notices.

Jon Brodkin – Jul 15, 2024 8: 30 pm UTC

Getty Images | Smith Collection/Gado

Major record labels sued Verizon on Friday, alleging that the Internet service provider violated copyright law by continuing to serve customers accused of pirating music. Verizon “knowingly provides its high-speed service to a massive community of online pirates,” said the complaint filed in US District Court for the Southern District of New York.

Universal, Sony, and Warner say they have sent over 340,000 copyright infringement notices to Verizon since early 2020. “Those notices identify specific subscribers on Verizon’s network stealing Plaintiffs’ sound recordings through peer-to-peer (‘P2P’) file-sharing networks that are notorious hotbeds for copyright infringement,” the lawsuit said.

Record labels allege that “Verizon ignored Plaintiffs’ notices and buried its head in the sand” by “continu[ing] to provide its high-speed service to thousands of known repeat infringers so it could continue to collect millions of dollars from them.” They say that “Verizon has knowingly contributed to, and reaped substantial profits from, massive copyright infringement committed by tens of thousands of its subscribers.”

The firms allege that Verizon is guilty of contributory and vicarious copyright infringement and should have to pay damages of up to $150,000 for each work infringed. Plaintiffs filed what they call a “non-exhaustive” list of infringed works that includes 17,335 titles. That would imply requested damages of over $2.6 billion.

Numerous lawsuits against ISPs

Record labels and movie studios have filed numerous copyright lawsuits against Internet providers. Perhaps the most significant ongoing case involves Cox Communications, which has been fighting a $1 billion jury verdict since 2019.

Cox received support from groups such as the Electronic Frontier Foundation, which warned that the big money judgment could cause broadband providers to disconnect people from the Internet based only on accusations of copyright infringement. The US Court of Appeals for the 4th Circuit overturned the $1 billion verdict in February 2024, rejecting Sony’s claim that Cox profited directly from copyright infringement committed by users of Cox’s cable broadband network.

While judges in the Cox case reversed a vicarious liability verdict, they affirmed the jury’s additional finding of willful contributory infringement and ordered a new damages trial.

Cox recently said it is seeking a Supreme Court review on the questions of “whether an Internet service provider materially contributes to copyright infringement by declining to disconnect an Internet account knowing someone is likely to use it to infringe,” and “whether a secondary infringer can be adjudged willful based merely on knowledge of another’s direct infringement.” There is a circuit split on both questions, Cox said.

4,450 notices about one IP address

In the Verizon case, record labels claim that thousands of Verizon subscribers “were the subject of 20 or more notices from Plaintiffs, and more than 500 subscribers were the subject of 100 or more notices. One particularly egregious Verizon subscriber was single-handedly the subject of 4,450 infringement notices from Plaintiffs alone.”

That Verizon subscriber’s IP address was identified in 4,450 infringement notices between March 2021 and August 2023, the lawsuit said. Two other subscribers were allegedly the subject of 2,703 and 2,068 infringement notices, respectively.

“Verizon acknowledged that it received these notices of infringement sent by Plaintiffs’ representatives,” the lawsuit said. “Yet rather than taking any steps to address its customers’ illegal use of its network, Verizon deliberately chose to ignore Plaintiffs’ notices, willfully blinding itself to that information and prioritizing its own profits over its legal obligations.”

The plaintiffs claim that “Verizon has gone out of its way not to take action against subscribers engaging in repeated copyright infringement,” and “failed to terminate or otherwise take any meaningful action against the accounts of repeat infringers of which it was aware.”

“It is well-established law that if a party materially assists someone it knows is engaging in copyright infringement, that party is fully liable for the infringement as if it had infringed directly,” the lawsuit said.

Complaint system too onerous, suit claims

The lawsuit also complains that Verizon hasn’t made it easier for copyright owners to file complaints about Internet users:

Through one channel, Verizon claims to allow copyright holders to send P2P notices through a so-called “Anti-Piracy Cooperation Program,” but it has attached such onerous conditions to participation that the program is rendered a nullity. Not only has Verizon required participants to pay burdensome fees for simple, automated processes like Internet Protocol (“IP”) address lookups and notice forwarding, but participants have been required to waive their copyright claims, broadly indemnify Verizon, and, tellingly, keep the terms of the program confidential. Verizon has also limited the number of notices it will forward pursuant to the program.

The lawsuit said Verizon also allows copyright owners to send email notices of infringement instead of using the channel described above. The email method apparently doesn’t require copyright owners to waive their copyright claims or make payments, but the lawsuit alleges that “Verizon does not forward these notices to subscribers or track the number of email notices sent regarding repeat infringing subscribers. Verizon also arbitrarily caps the number of notices permitted per copyright holder at this address—ironic, to say the least, given that Verizon ignored hundreds of thousands of Plaintiffs’ notices to this email inbox.”

We contacted Verizon about the lawsuit and will update this article if it provides a response.

Record labels sue Verizon for not disconnecting pirates’ Internet service Read More »