Policy – Page 26

This “smoking gun” killed the McDonald’s ice cream hackers’ startup

DMCA, DMCA abuse, ice cream, mcdonalds, Policy, Science, syndication / Ryan Harris / December 16, 2023

A little over three years have passed since McDonald’s sent out an email to thousands of its restaurant owners around the world that abruptly cut short the future of a three-person startup called Kytch—and with it, perhaps one of McDonald’s best chances for fixing its famously out-of-order ice cream machines.

Until then, Kytch had been selling McDonald’s restaurant owners a popular Internet-connected gadget designed to attach to their notoriously fragile and often broken soft-serve McFlurry dispensers, manufactured by McDonald’s equipment partner Taylor. The Kytch device would essentially hack into the ice cream machine’s internals, monitor its operations, and send diagnostic data over the Internet to an owner or manager to help keep it running. But despite Kytch’s efforts to solve the Golden Arches’ intractable ice cream problems, a McDonald’s email in November 2020 warned its franchisees not to use Kytch, stating that it represented a safety hazard for staff. Kytch says its sales dried up practically overnight.

Now, after years of litigation, the ice-cream-hacking entrepreneurs have unearthed evidence that they say shows that Taylor, the soft-serve machine maker, helped engineer McDonald’s Kytch-killing email—kneecapping the startup not because of any safety concern, but in a coordinated effort to undermine a potential competitor. And Taylor’s alleged order, as Kytch now describes it, came all the way from the top.

On Wednesday, Kytch filed a newly unredacted motion for summary adjudication in its lawsuit against Taylor for alleged trade libel, tortious interference, and other claims. The new motion, which replaces a redacted version from August, refers to internal emails Taylor released in the discovery phase of the lawsuit, which were quietly unsealed over the summer. The motion focuses in particular on one email from Timothy FitzGerald, the CEO of Taylor parent company Middleby, that appears to suggest that either Middleby or McDonald’s send a communication to McDonald’s franchise owners to dissuade them from using Kytch’s device.

“Not sure if there is anything we can do to slow up the franchise community on the other solution,” FitzGerald wrote on October 17, 2020. “Not sure what communication from either McD or Midd can or will go out.”

In their legal filing, the Kytch co-founders, of course, interpret “the other solution” to mean their product. In fact, FitzGerald’s message was sent in an email thread that included Middleby’s then COO, David Brewer, who had wondered earlier whether Middleby could instead acquire Kytch. Another Middleby executive responded to FitzGerald on October 17 to write that Taylor and McDonald’s had already met the previous day to discuss sending out a message to franchisees about McDonald’s lack of support for Kytch.

But Jeremy O’Sullivan, a Kytch co-founder, claims—and Kytch argues in its legal motion—that FitzGerald’s email nonetheless proves Taylor’s intent to hamstring a potential competitor. “It’s the smoking gun,” O’Sullivan says of the email. “He’s plotting our demise.”

Although FitzGerald’s email doesn’t actually order anyone to act against Kytch, the company’s motion argues that Taylor played a key role in what happened next. It’s an “ambiguous yet direct message to his underlings,” argues Melissa Nelson, Kytch’s other co-founder. “It’s just like a mafia boss giving coded instructions to his team to whack someone.”

On November 2, 2020, a little over two weeks after FitzGerald’s open-ended suggestion that perhaps a “communication” from McDonald’s or Middleby to franchisees could “slow up” adoption of “the other solution,” McDonald’s sent out its email blast cautioning restaurant owners not to use Kytch’s product.

The email stated that the Kytch gadget “allows complete access to all aspects of the equipment’s controller and confidential data”—meaning Taylor’s and McDonald’s data, not the restaurant owners’ data; that it “creates a potential very serious safety risk for the crew or technician attempting to clean or repair the machine”; and finally, that it could cause “serious human injury.” The email concluded with a warning in italics and bold: “McDonald’s strongly recommends that you remove the Kytch device from all machines and discontinue use.”

This “smoking gun” killed the McDonald’s ice cream hackers’ startup Read More »

Marketer sparks panic with claims it uses smart devices to eavesdrop on people

ads, Policy, Tech, voice assistant / Ryan Harris / December 15, 2023

We’ve all experienced it or heard about it happening: Someone has a conversation about wanting a red jacket, and then suddenly, it seems like they’re seeing ads for red jackets all over the place.

Makers of microphone-equipped electronics sometimes admit to selling voice data to third parties (advertisers). But that’s usually voice data accumulated after a user has prompted their device to start listening to them and after they’ve opted into (preferably not by default) this sort of data collection.

But a marketing company called CMG Local Solutions sparked panic recently by alluding that it has access to people’s private conversations by tapping into data gathered by the microphones on their phones, TVs, and other personal electronics, as first reported by 404 Media on Thursday. The marketing firm had said it uses these personal conversations for ad targeting.

Active Listening

CMG’s Active Listening website starts with a banner promoting an accurate but worrisome statement, “It’s true. Your devices are listening to you.”

A November 28 blog post described Active Listening technology as using AI to “detect relevant conversations via smartphones, smart TVs, and other devices.” As such, CMG claimed that it knows “when and what to tune into.”

The blog also shamelessly highlighted advertisers’ desire to hear every single whisper made that could help them target campaigns:

This is a world where no pre-purchase murmurs go unanalyzed, and the whispers of consumers become a tool for you to target, retarget, and conquer your local market.

The marketing company didn’t thoroughly detail how it backs its claims. An archived version of the Active Listening site provided a vague breakdown of how Active Listening purportedly works.

The website previously pointed to CMG uploading past client data into its platform to make “buyer personas.” Then, the company would identify relevant keywords for the type of person a CMG customer would want to target. CMG also mentioned placing a tracking pixel on its customers’ sites before entering the Listening Stage, which was only described as: “Active Listening begins and is analyzed via AI to detect pertinent conversations via smartphones, smart TVs, and other devices.”

The archived version of the page discussed an AI-based analysis of the data and generating an “encrypted evergreen audience list” used to re-target ads on various platforms, including streaming TV and audio, display ads, paid social media, YouTube, Google, and Bing Search.

That explanation doesn’t appear to be on the Active Listening page anymore, but CMG still says it can target people who are actively saying things like, “A minivan would be perfect for us” or “This AC is on it’s [sic] last leg!” in conversations.

But are they actively listening?

In a statement emailed to Ars Technica, Cox Media Group said that its advertising tools include “third-party vendor products powered by data sets sourced from users by various social media and other applications then packaged and resold to data servicers.” The statement continues:

Advertising data based on voice and other data is collected by these platforms and devices under the terms and conditions provided by those apps and accepted by their users, and can then be sold to third-party companies and converted into anonymized information for advertisers. This anonymized data then is resold by numerous advertising companies.

The company added that it does not “listen to any conversations or have access to anything beyond a third-party aggregated, anonymized and fully encrypted data set that can be used for ad placement” and “regret[s] any confusion.”

Before Cox Media Group sent its statement, though, CMG’s claims of collecting data on “casual conversations in real-time,” as its blog stated, were questionable. CMG never explained how our devices would somehow be able to garner the computing and networking power necessary to record and send every conversation spoken within the device’s range in “real-time,” unbeknownst to the device’s owner. The firm also never explained how it acquired the type of access that requires law enforcement to obtain a warrant. This is despite CMG’s blog claiming that with Active Listening, advertisers would be able to know “the second someone in your area is concerned about mold in their closet,” for example.

CMG’s November blog post pointed to an unnamed technology partner that can “aggregate and analyze voice data during pre-purchase conversations,” as well as a “growing ability to access microphone data on devices.”

Marketer sparks panic with claims it uses smart devices to eavesdrop on people Read More »

TikTok requires users to “forever waive” rights to sue over past harms

bytedance, child safety, class action lawsuit, montana, Policy, social media platforms, tiktok, TikTok ban / Ryan Harris / December 15, 2023

Or forever hold your peace —

TikTok may be seeking to avoid increasingly high costs of mass arbitration.

Ashley Belanger – Dec 15, 2023 6: 57 pm UTC

Some TikTok users may have skipped reviewing an update to TikTok’s terms of service this summer that shakes up the process for filing a legal dispute against the app. According to The New York Times, changes that TikTok “quietly” made to its terms suggest that the popular app has spent the back half of 2023 preparing for a wave of legal battles.

In July, TikTok overhauled its rules for dispute resolution, pivoting from requiring private arbitration to insisting that legal complaints be filed in either the US District Court for the Central District of California or the Superior Court of the State of California, County of Los Angeles. Legal experts told the Times this could be a way for TikTok to dodge arbitration claims filed en masse that can cost companies millions more in fees than they expected to pay through individual arbitration.

Perhaps most significantly, TikTok also added a section to its terms that mandates that all legal complaints be filed within one year of any alleged harm caused by using the app. The terms now say that TikTok users “forever waive” rights to pursue any older claims. And unlike a prior version of TikTok’s terms of service archived in May 2023, users do not seem to have any options to opt out of waiving their rights.

TikTok did not immediately respond to Ars’ request to comment, but has previously defended its “industry-leading safeguards for young people,” the Times noted.

Lawyers told the Times that these changes could make it more challenging for TikTok users to pursue legal action at a time when federal agencies are heavily scrutinizing the app and complaints about certain TikTok features allegedly harming kids are mounting.

In the past few years, TikTok has had mixed success defending against user lawsuits filed in courts. In 2021, TikTok was dealt a $92 million blow after settling a class-action lawsuit filed in an Illinois court, which alleged that the app illegally collected underage TikTok users’ personal data. Then, in 2022, TikTok defeated a Pennsylvania lawsuit alleging that the app was liable for a child’s death because its algorithm promoted a deadly “Blackout Challenge.” The same year, a bipartisan coalition of 44 state attorneys general announced an investigation to determine whether TikTok violated consumer laws by allegedly putting young users at risk.

Section 230 shielded TikTok from liability in the 2022 “Blackout Challenge” lawsuit, but more recently, a California judge ruled last month that social media platforms—including TikTok, Facebook, Instagram, and YouTube—couldn’t use a blanket Section 230 defense in a child safety case involving hundreds of children and teens allegedly harmed by social media use across 30 states.

Some of the product liability claims raised in that case are tied to features not protected by Section 230 immunity, the judge wrote, opening up social media platforms to potentially more lawsuits focused on those features. And the Times reported that investigations like the one launched by the bipartisan coalition “can lead to government and consumer lawsuits.”

As new information becomes available to consumers through investigations and lawsuits, there are concerns that users may become aware of harms that occurred before TikTok’s one-year window to file complaints and have no path to seek remedies.

However, it’s currently unclear if TikTok’s new terms will stand up against legal challenges. University of Chicago law professor Omri Ben-Shahar told the Times that TikTok might struggle to defend its new terms in court, and it looks like TikTok is already facing pushback. One lawyer representing more than 1,000 guardians and minors claiming TikTok-related harms, Kyle Roche, told the Times that he is challenging TikTok’s updated terms. Roche said that the minors he represents “could not agree to the changes” and intended to ignore the updates, instead bringing their claims through private arbitration.

TikTok has also spent the past year defending against attempts by lawmakers to ban the China-based app in the US over concerns that the Chinese Communist Party (CCP) may use the app to surveil Americans. Congress has weighed different bipartisan bills with names like “ANTI-SOCIAL CCP Act” and “RESTRICT Act,” each intent to lay out a legal path to ban TikTok nationwide over alleged national security concerns.

So far, TikTok has defeated every attempt to widely ban the app, but that doesn’t mean lawmakers have any plans to stop trying. Most recently, a federal judge stopped Montana’s effort to ban TikTok statewide from taking effect, but a more limited TikTok ban restricting access on state-owned devices was upheld in Texas, Reuters reported.

TikTok requires users to “forever waive” rights to sue over past harms Read More »

Judge rejects Elon Musk’s attempt to avoid testifying in Twitter stock probe

elon musk, elon musk sec, Policy / Ryan Harris / December 15, 2023

A loss for Elon —

Musk has to testify for SEC probe into whether he violated US securities laws.

Jon Brodkin – Dec 15, 2023 5: 35 pm UTC

Illustration of a stamp that prints the word — Getty Images | Bet_Noire

Elon Musk can’t avoid testifying in an investigation into whether he violated federal securities laws, a magistrate judge said during a court hearing yesterday.

The Securities and Exchange Commission sued Musk in October to force him to testify for a third time in a probe related to purchases of Twitter stock he made before he bought the company. Musk responded in November by asking the court to block the SEC’s subpoena, claiming the agency is “harassing” him, exceeding its authority to investigate, and making “overly burdensome” demands for “irrelevant evidence.”

Musk’s arguments were rejected during a hearing yesterday in US District Court for the Northern District of California. No formal ruling has been issued yet, but a magistrate judge made it clear she will rule in the SEC’s favor if Musk doesn’t appear for testimony.

“During a hearing in San Francisco, US Magistrate Judge Laurel Beeler quickly rejected arguments by Musk’s attorney that SEC officials do not have the authority to issue subpoenas, saying the agency has broad investigative powers and that no judge would ‘second guess’ an SEC probe,” Reuters reported.

According to Reuters, “Beeler told the sides to figure out when Musk would sit for one more four-hour deposition, or she would issue an order” compelling Musk to testify. “If you don’t work it out, then it’s in San Francisco in February,” Beeler said.

SEC probing Twitter stock purchases

The SEC lawsuit said the subpoena that Musk failed to comply with is for an investigation into whether “Musk violated various provisions of the federal securities laws in connection with (1) his 2022 purchases of Twitter stock, and (2) his 2022 statements and SEC filings relating to Twitter.”

The SEC began its investigation in April 2022 after Musk acquired a 9 percent stake in Twitter and failed to disclose it within 10 days as required under US law. Musk testified twice in July 2022, but the SEC said it has obtained thousands of new documents since then and “has not yet had an opportunity to question Musk about those documents and other substantial information it has obtained in its investigation.”

The SEC told the court that its investigation into whether Musk violated securities laws “pertains to considerably more than the timing and substance of a particular SEC filing; it also relates to all of Musk’s purchases of Twitter stock in 2022 and his 2022 statements and SEC filings.”

Musk’s response complained that “the SEC has opened one investigation after another into Mr. Musk and companies related to him, often targeting its inquiries into his constitutionally protected rights.” Musk alleged that the SEC probe has focused on his political beliefs and “passion for the First Amendment,” and “reeks of McCarthyism that has no place in a free country.”

Judge “emphatically” rejected Musk argument

Beeler “emphatically” dismissed arguments put forward by Musk’s attorney yesterday, according to Reuters. “You’ve got one more four-hour deposition, one more day of depositions to survive and it’s over. It seems unlikely there’s going to be any more hassle,” Beeler was quoted as saying.

Musk’s filing also claimed that SEC enforcement staff members cannot issue subpoenas due to requirements in the Constitution’s Appointments Clause. “The issuance of an administrative subpoena demanding Mr. Musk’s testimony is an exercise of significant governmental authority of the kind that can be performed only by ‘Officers of the United States,'” Musk’s filing said. “And under Article II, such officers can be appointed only by the President, a court, or the head of a department.”

According to Reuters, Beeler “said she is inclined to take the SEC’s view on the [Appointments Clause] issue but would take a closer look before issuing her order.”

Separately, Musk last week asked the Supreme Court to terminate a settlement that requires him to get Tesla’s pre-approval for tweets or other social media posts that may contain information material to the company or its shareholders. Musk agreed to the settlement after the SEC said his August 2018 tweets claiming he had secured funding to take Tesla private were false and caused significant market disruption.

Musk’s attempts to terminate the settlement with the SEC were previously rejected by a US district court and a federal appeals court.

Judge rejects Elon Musk’s attempt to avoid testifying in Twitter stock probe Read More »

Elon Musk told bankers they wouldn’t lose any money on Twitter purchase

elon musk, Policy, syndication, Twitter, X / Ryan Harris / December 15, 2023

Value destruction —

Lenders unlikely to get even 60 cents on the dollar for the bonds and loans.

Joshua Franklin, Eric Platt, Ortenca Aliaj, and Hannah Murphy, FT – Dec 15, 2023 3: 06 pm UTC

Elon Musk privately told some of the bankers who lent him $13 billion to fund his leveraged buyout of Twitter that they would not lose any money on the deal, according to five people familiar with the matter.

The verbal guarantees were made by Musk to banks as a way to reassure the lenders as the value of the social media site, now rebranded as X, fell sharply after he completed the acquisition last year.

Despite the assurances, the seven banks that lent money to the billionaire for his buyout—Morgan Stanley, Bank of America, Barclays, MUFG, BNP Paribas, Mizuho and Société Générale—are facing serious losses on the debt if and when they eventually sell it.

The sources did not specify when Musk’s assurances were made, although one noted Musk had made them on several occasions. But the billionaire’s behavior, both in attempting to back out of the takeover in 2022 and more recently in alienating advertisers, has more broadly stymied the banks’ efforts to offload the debt since he engineered the takeover.

Large hedge funds and credit investors on Wall Street held conversations with the banks late last year, offering to buy the senior-most portion of the debt at roughly 65 cents on the dollar. But in recent interviews with the Financial Times, several said there was no price at which they would buy the bonds and loans, given their inability to gauge whether Linda Yaccarino, X’s chief executive, could turn the business around.

One multibillion-dollar firm that specializes in distressed debt called X’s debt “uninvestable.”

Selling the $12.5 billion of bonds and loans below 60 cents on the dollar—a price many investors believe the banks would be lucky to achieve in the current market—would imply losses before accounting for X’s interest payments of $4 billion or more, writedowns that have not yet been publicly reported by the syndicate of lenders, according to FT calculations. The debt is split between $6.5 billion of term loans, as well as $6 billion of senior and junior bonds and a $500 million revolver.

Morgan Stanley, Bank of America, Barclays, MUFG, BNP Paribas, Mizuho and Société Générale declined to comment. A spokesperson for X declined to comment. Musk did not return a request for comment.

The banks have held the debt on their balance sheets instead of selling at a steep loss in the hope that X’s performance will improve following a series of cost-cutting measures. Several people involved in the transaction noted that there was no plan to sell the debt imminently, with one saying there was no guarantee the banks would be able to offload the debt even in 2024.

The people involved in the deal cautioned that Musk’s guarantee was not based on any formal contract. One said they understood it as a boastful statement that the entrepreneur had never let his lenders down.

“I have never lost money for those who invest in me and I am not starting now,” he told Axios earlier this month, when asked about a separate fundraising push by his company X.ai Corp.

Some on Wall Street view Musk’s personal guarantees with skepticism, given that he tried to back out of his agreement to buy Twitter despite a watertight contract, before relenting.

Nevertheless, the guarantee from a man whose net worth Forbes pegs at about $243 billion has helped some of the bankers make the pitch to their internal committees that they can ascribe a higher price to the debt while they hold it on their balance sheets.

Morgan Stanley, the largest lender on the deal, in January disclosed $356 million in mark-to-market losses on corporate loans it planned to sell and loan hedges. Banks rarely report specific losses tied to an individual bond or loan, and often report write-downs of multiple deals together.

Wall Street was saddled with the Twitter buyout loan at the same time they were holding a smattering of other hung bridge loans—deals they were forced to fund themselves after failing to raise cash in public bond and loan markets. The FT has previously reported on large losses tied to other hung loans at the time, including the buyouts of technology company Citrix and television rating provider Nielsen.

How the debt has been marked on bank balance sheets has been an open question for traders and investors across Wall Street, given how much X’s business has deteriorated since Musk bought the company.

Musk, already out of favor with marketers for loosening content moderation, last month lost more advertisers after endorsing an antisemitic post. In November he followed by telling brands that were boycotting the business over his actions to “go fuck” themselves, criticizing Disney’s Bob Iger in particular.

According to a report last week from market intelligence firm Sensor Tower, in November 2023 total US ad spend among the top 100 advertisers on X was down nearly 45 percent compared with October 2022, prior to Musk’s takeover.

Elon Musk told bankers they wouldn’t lose any money on Twitter purchase Read More »

Suspects can refuse to provide phone passcodes to police, court rules

Fifth Amendment, phone passcode, Policy / Ryan Harris / December 14, 2023

A person's hand holding a smartphone while entering the screen-lock passcode. — Getty Images | releon8211

Criminal suspects can refuse to provide phone passcodes to police under the US Constitution’s Fifth Amendment privilege against self-incrimination, according to a unanimous ruling issued today by Utah’s state Supreme Court. The questions addressed in the ruling could eventually be taken up by the US Supreme Court, whether through review of this case or a similar one.

The case involves Alfonso Valdez, who was arrested for kidnapping and assaulting his ex-girlfriend. Police officers obtained a search warrant for the contents of Valdez’s phone but couldn’t crack his passcode.

Valdez refused to provide his passcode to a police detective. At his trial, the state “elicited testimony from the detective about Valdez’s refusal to provide his passcode when asked,” today’s ruling said. “And during closing arguments, the State argued in rebuttal that Valdez’s refusal and the resulting lack of evidence from his cell phone undermined the veracity of one of his defenses. The jury convicted Valdez.”

A court of appeals reversed the conviction, agreeing “with Valdez that he had a right under the Fifth Amendment to the United States Constitution to refuse to provide his passcode, and that the State violated that right when it used his refusal against him at trial.” The Utah Supreme Court affirmed the court of appeals ruling.

Case possibly ripe for Supreme Court review

The ruling offered some commentary on the developing legal questions about device passcodes:

The prevalence of passcodes that encrypt the information on electronic devices—which are often seized by law enforcement while investigating criminal conduct—has raised important questions about how the Fifth Amendment extends to law enforcement’s efforts to unlock these devices and decrypt the contents inside. These questions have proven to be especially complex where law enforcement attempts to access the contents of a seized device by means that do not require the suspect to disclose the actual passcode—like, for example, obtaining an order to compel the suspect to provide an unlocked device.

The Valdez case does not involve an order to compel a suspect to unlock a device. Instead, “law enforcement asked Valdez to verbally provide his passcode,” Utah justices wrote. “While these circumstances involve modern technology in a scenario that the Supreme Court has not yet addressed, we conclude that these facts present a more straightforward question that is answered by settled Fifth Amendment principles.”

Ruling against the state, the Utah Supreme Court said it “agree[s] with the court of appeals that verbally providing a cell phone passcode is a testimonial communication under the Fifth Amendment.”

Berkeley Law Professor Orin Kerr wrote today that the case could head to the US Supreme Court. “One of the major issues in the law of digital evidence investigations is how the Fifth Amendment privilege against self-incrimination applies to unlocking phones,” Kerr wrote.

So far, “the lower court case law is a total mess,” according to Kerr. “No one can say what the law is. And I’ve been waiting for a case to come down that might be a good candidate for US Supreme Court review to clear up the mess.”

Suspects can refuse to provide phone passcodes to police, court rules Read More »

Twitch allowing more nudity after disproportionately banning female streamers

adult content, adult entertainment, live streaming, mature content, Policy, twitch / Ryan Harris / December 14, 2023

“Bravo, Twitch!” —

Twitch confirmed its policy banning nudity was sexist.

Ashley Belanger – Dec 14, 2023 8: 44 pm UTC

Twitch users have finally pushed the interactive livestreaming service to allow more nudity after years of banning mostly female-presenting streamers who were penalized for violating sexual content policies that Twitch now admits were too confusing.

In one prominent example, just two days before the policy change, Twitch banned OnlyFans model Morgpie for posting “topless” streams. Although Morgpie’s videos were shot to imply nudity, they “never actually showed content that explicitly violated Twitch’s sexual content policies,” TechCrunch reported. To critics, Twitch’s rationale for banning Morgpie remains unclear.

In a blog, Twitch Chief Customer Trust Officer Angela Hession wrote that Twitch “received consistent feedback from streamers that our current policies around sexual content are confusing and that it can be difficult to know how their content will be interpreted based on these policies.”

Hession confirmed that Twitch’s policy prohibiting “content that ‘deliberately highlighted breasts, buttocks or pelvic region,’ even when fully clothed” was confusing.

“Streamers found it difficult to determine what was prohibited and what was allowed and often evaluating whether or not a stream violated this portion of the policy was subjective,” Hession wrote.

Combined with another policy that restricted “sexually suggestive” content, Twitch’s former policy was found to be “overly punitive” and “resulted in female-presenting streamers being disproportionately penalized,” Hession wrote.

In an effort to eliminate confusion, Twitch announced that it had consolidated two separate policies that addressed sexual content under Twitch’s community guidelines into one single sexual content policy. That policy “specifies the types of sexual content that are prohibited on Twitch” and clarifies enforcement.

Another key part of the policy overhaul, Twitch has also begun allowing some sexual content that was previously restricted, so long as appropriate Content Classification Labels (CCLs) indicating sexual themes are applied.

Now, labeled content that “deliberately highlighted breasts, buttocks or pelvic region” is allowed, as well as content with “fictionalized (drawn, animated, or sculpted) fully exposed female-presenting breasts and/or genitals or buttocks regardless of gender” and “body writing on female-presenting breasts and/or buttocks regardless of gender.” Streamers can also label content featuring “erotic dances that involve disrobing or disrobing gestures, such as strip teases.”

These labels will ensure that content is not removed but also prevent mature content from being promoted on the homepage, Hession wrote, ensuring that no Twitch user ever encounters inappropriate content that they do not wish to see. The only exceptions will be made for streams labeled as including mature-rated games and profanity, which will still appear in the main feed on the homepage. Streams with sexual themes labels will, however, still be recommended in the left bar of the homepage, where a thumbnail isn’t displayed.

“We believe that accurate content labeling is key to helping viewers get the experience they expect, and now that we can enable appropriate labeling of sexual content using CCLs we believe that some of the restrictions in our former policies are no longer required,” Hession wrote. “In addition to providing clarity, these updates will also reduce the risk of inconsistent enforcement and bring our policy more in line with other social media services.”

Failing to label sexual content can result in penalties, like warnings, but not suspensions, Hession wrote. Twitch will automatically apply labels to sexual content missing labels, and any repeated failure to label content could result in a label “temporarily locked onto the stream.”

Some sexual content is still prohibited, including pornographic content, youth nudity, “fictionalized sexual acts or masturbation,” and “simulated sexual activity or erotic roleplay with other players in online games.” Uploading such prohibited content can result in content removals or account suspensions. A complete overview of what’s still banned can be found here.

For many Twitch users, changes to the sexual content policy likely feel long overdue. Although her ban is reportedly still in effect, Morgpie praised Twitch’s update in a statement to Dexerto.

“With the updated terms of service, content on Twitch containing mature themes will be allowed but no longer pushed on the homepage of the site,” Morgpie told Dexerto. “I think this is the best possible outcome, because it gives creators much more freedom, while also keeping this content from reaching the wrong audience. Bravo, Twitch!”

Twitch allowing more nudity after disproportionately banning female streamers Read More »

Trains were designed to break down after third-party repairs, hackers find

DRM, gps tracker, Newag, Poland, Policy, right to repair, trains / Ryan Harris / December 13, 2023

Unlocking the secret —

The train manufacturer accused the hackers of slander.

Ashley Belanger – Dec 13, 2023 10: 14 pm UTC

Enlarge / Dragon Sector uploaded a video to social media after discovering an “undocumented ‘unlock code’ which you could enter from the train driver’s panel” fixed “mysterious issues” impacting trains in Poland.

An unusual right-to-repair drama is disrupting railroad travel in Poland despite efforts by hackers who helped repair trains that allegedly were designed to stop functioning when serviced by anyone but Newag, the train manufacturer.

Members of an ethical hacking group called Dragon Sector, including Sergiusz Bazański and Michał Kowalczyk, were called upon by a train repair shop, Serwis Pojazdów Szynowych (SPS), to analyze train software in June 2022. SPS was desperate to figure out what was causing “mysterious failures” that shut down several vehicles owned by Polish train operator the Lower Silesian Railway, Polish infrastructure trade publication Rynek Kolejowy reported. At that point, the shortage of trains had already become “a serious problem” for carriers and passengers, as fewer available cars meant shorter trains and reduced rider capacity, Rynek Kolejowy reported.

Dragon Sector spent two months analyzing the software, finding that “the manufacturer’s interference” led to “forced failures and to the fact that the trains did not start,” and concluding that bricking the trains “was a deliberate action on Newag’s part.”

According to Dragon Sector, Newag entered code into the control systems of Impuls trains to stop them from operating if a GPS tracker indicated that the train was parked for several days at an independent repair shop.

The trains “were given the logic that they would not move if they were parked in a specific location in Poland, and these locations were the service hall of SPS and the halls of other similar companies in the industry,” Dragon Sector’s team alleged. “Even one of the SPS halls, which was still under construction, was included.”

The code also allegedly bricked the train if “certain components had been replaced without a manufacturer-approved serial number,” 404 Media reported.

In a statement, Newag denied developing any so-called “workshop-detection” software that caused “intentional failures” and threatened to sue Dragon Sector for slander and for violating hacking laws.

“Hacking IT systems is a violation of many legal provisions and a threat to railway traffic safety,” Newag said, insisting that the hacked trains be removed from use because they now pose alleged safety risks. Newag’s safety claims are still unsubstantiated, 404 Media reported.

“We categorically deny and negate Newag’s uploading of any functionality in vehicle control systems that limits or prevents the proper operation of vehicles, as well as limiting the group of entities that can provide maintenance or repair services,” Newag’s statement said. According to Newag, Dragon Sector’s report shouldn’t be trusted because it was commissioned by one of Newag’s biggest competitors.

Dragon Sector maintains that the evidence supports its conclusions. Bazański posted on Mastodon that “these trains were locking up for arbitrary reasons after being serviced at third-party workshops. The manufacturer argued that this was because of malpractice by these workshops, and that they should be serviced by them instead of third parties.” In some cases, Bazański wrote, Newag “appeared to be able to lock the train remotely.”

Newag has said that “any remote intervention” is “virtually impossible.”

Lawsuit threats fails to silence hackers

Dragon Sector got the trains running after discovering “an undocumented ‘unlock code’ which you could enter from the train driver’s panel which magically fixed the issue,” Dragon Sector’s team told 404 Media.

Newag has maintained that it has never and will never “introduce into the software of our trains any solutions that lead to intentional failures.”

“We do not know who interfered with the train control software, using what methods and what qualifications,” Newag said. “We also notified the Office of Rail Transport about this so that it could decide to withdraw from service the sets subjected to the activities of unknown hackers.”

Dragon Sector and SPS have denied interfering with the train’s control systems.

While Newag has contacted authorities to investigate the hacking, Janusz Cieszyński, Poland’s former minister of digital affairs, posted on X that the evidence appears to weigh against Newag.

“The president of Newag contacted me,” Cieszyński wrote. “He claims that Newag fell victim to cybercriminals and it was not an intentional action by the company. The analysis I saw indicated something else, but for the sake of clarity, I will write about everything.

Newag president Zbigniew Konieczek said that “no evidence was provided that our company intentionally installed the faulty software. In our opinion, the truth may be completely different—that, for example, the competition interfered with the software.”

Konieczek also accused Cieszyński of disseminating “false and highly harmful information about Newag.”

404 Media noted that Newag appeared to be following a common playbook in the right-to-repair world where manufacturers intimidate competitor repair shops with threatened lawsuits and unsubstantiated claims about safety risks of third-party repairs. So far, Dragon Sector does not appear intimidated, posting its success on YouTube and discussing its findings at Poland’s Oh My H@ck conference in Warsaw. The group is also planning “a more detailed presentation” for the 37th Chaos Communication Congress in Hamburg, Germany, at the end of December, The Register reported.

Because of the evidence gathered during their analysis, the Dragon Sector team has doubts about whether Newag will actually follow through with the lawsuit.

“Their defense line is really poor, and they would have no chance defending it,” Kowalczk told 404 Media. “They probably just want to sound scary in the media.”

Trains were designed to break down after third-party repairs, hackers find Read More »

SpaceX blasts FCC as it refuses to reinstate Starlink’s $886 million grant

FCC, Policy, spacex starlink / Ryan Harris / December 13, 2023

A Starlink broadband satellite dish placed outside on the ground. — Enlarge / Starlink satellite dish.

Getty Images | olegda88

SpaceX is furious at the Federal Communications Commission after the agency refused to reinstate an $886 million broadband grant that was tentatively awarded to Starlink during the previous administration.

The FCC announced yesterday that it rejected SpaceX’s appeal. “The FCC followed a careful legal, technical and policy review to determine that this applicant had failed to meet its burden to be entitled to nearly $900 million in universal service funds for almost a decade,” FCC Chairwoman Jessica Rosenworcel said.

In December 2020, shortly before the departure of then-FCC Chairman Ajit Pai, Starlink was tentatively awarded $885.51 million in broadband funding from the Rural Digital Opportunity Fund (RDOF). But the satellite provider still needed FCC approval of a long-form application to receive the money, which is meant to subsidize deployment in areas with little or no high-speed broadband access.

The Rosenworcel FCC rejected the long-form application in August 2022, and SpaceX appealed the decision the next month. The FCC also rejected the long-form application of LTD Broadband, a fixed wireless provider that was originally slated to get $1.3 billion. LTD recently renamed itself “GigFire.”

The Starlink and LTD rejections were the two biggest changes to a $9.2 billion round of grants that, in the Rosenworcel FCC’s words, fueled “complaints that the program was poised to fund broadband to parking lots and well-served urban areas.” The FCC denied LTD’s appeal last week and proposed a fine of $21.7 million for defaulting on grant bids.

SpaceX “disappointed and perplexed”

After yesterday’s Starlink denial, SpaceX quickly filed a response saying the company “is deeply disappointed and perplexed by the Commission’s decision to exclude SpaceX’s Starlink satellite broadband service from the Rural Digital Opportunity Fund.”

“This decision directly undermines the very goal of RDOF: to connect unserved and underserved Americans,” SpaceX told the FCC. “Starlink is demonstrably one of the best options—likely the best option—to accomplish the goals of RDOF. Indeed, Starlink is arguably the only viable option to immediately connect many of the Americans who live and work in the rural and remote areas of the country where high-speed, low-latency Internet has been unreliable, unaffordable, or completely unavailable, the very people RDOF was supposed to connect.”

We asked SpaceX whether it plans to appeal in court and will update this article if we get an answer.

Starlink’s grant was intended to subsidize deployment to 642,925 rural homes and businesses in 35 states. The August 2022 ruling that rejected the grant called Starlink a “nascent LEO [low Earth orbit] satellite technology” with “recognized capacity constraints.” The FCC questioned Starlink’s ability to consistently provide low-latency service with the required download speeds of 100Mbps and upload speeds of 20Mbps.

In rejecting SpaceX’s appeal, yesterday’s FCC order said the agency’s Wireline Competition Bureau “followed Commission guidance and correctly concluded that Starlink is not reasonably capable of offering the required high-speed, low-latency service throughout the areas where it won auction support.”

SpaceX CEO Elon Musk has acknowledged Starlink’s capacity limits several times, saying for example that it will face “a challenge [serving everyone] when we get into the several million user range.”

SpaceX blasts FCC as it refuses to reinstate Starlink’s $886 million grant Read More »

Ted Cruz wants to stop the FCC from updating data-breach notification rules

data breach, federal communications commission, Policy, ted cruz / Blake Jones / December 12, 2023

Sen. Ted Cruz speaks at a Senate committee hearing while holding up three fingers. — Enlarge / Sen. Ted Cruz (R-Texas) at a Senate Judiciary Committee hearing on Thursday, November 30, 2023.

Getty Images | Bill Clark

Sen. Ted Cruz (R-Texas) and other Republican senators are fighting a Federal Communications Commission plan to impose new data-breach notification requirements on telecom providers. In a letter sent to FCC Chairwoman Jessica Rosenworcel today, the senators claim the pending FCC action would violate a congressional order.

The letter was sent by Cruz, Sen. Minority Leader Mitch McConnell (R-Ky.), Sen. John Thune (R-S.D.), and Sen. Marsha Blackburn (R-Tenn.). They say the proposed data-breach notification rules are preempted by an action Congress took in 2017 to kill an assortment of privacy and security rules issued by the FCC.

The Congressional Review Act (CRA) was used in 2017 by Congress and then-President Donald Trump to throw out rules that would have required home Internet and mobile broadband providers to get consumers’ opt-in consent before using, sharing, or selling Web browsing history, app usage history, and other private information.

The invalidated FCC rules also included data-breach notification requirements that are similar to those the current FCC now plans to impose. The FCC already enforces data-breach notification requirements, but the pending proposal would expand the scope of those rules.

Rosenworcel’s data-breach proposal is scheduled for a vote at tomorrow’s commission meeting, and it may ultimately be up to the courts to decide whether it violates the 2017 congressional resolution. The Republican senators urged the FCC to rescind the draft plan and remove it from the meeting agenda.

Cruz also protested a recent FCC vote to enforce rules that prohibit discrimination in access to broadband services, calling it “government-mandated affirmative action and race-based pricing.”

Republicans: FCC plan “clearly unlawful”

When an agency-issued rule is nullified by a Congressional Review Act resolution, that rule “may not be reissued in substantially the same form” without authorization from Congress. The key legal question seems to be whether the FCC can re-implement one portion of the nullified rules as long as it doesn’t bring back the entire privacy order.

Cruz and fellow Republicans say that Rosenworcel’s plan would “resurrect a portion of the 2016 Broadband Privacy Order pertaining to data security.”

“This is clearly unlawful: the FCC’s proposed rules in the Report and Order are clearly ‘substantially similar’ to the nullified 2016 rules,” they wrote. “Specifically, the requirements in the Report and Order governing notification to the FCC, law enforcement, and consumers, as well as the recordkeeping requirements with respect to breaches and notifications, are substantially similar to the notification and recordkeeping requirements disapproved by Congress.”

The FCC proposal anticipates this argument but says the agency believes it can re-implement part of the Obama-era privacy order:

We conclude that it would be erroneous to construe the resolution of disapproval as applying to anything other than all of the rule revisions, as a whole, adopted as part of the 2016 Privacy Order. That resolution had the effect of nullifying each and every provision of the 2016 Privacy Order—each part being, under the APA [Administrative Procedure Act], “a rule”—but not “the rule” specified in the resolution of disapproval. By its terms, the CRA does not prohibit the adoption of a rule that is merely substantially similar to a limited portion of the disapproved rule or one that is the same as individual pieces of the disapproved rule.

Thus, according to the FCC proposal, the resolution “does not prohibit the Commission from revising its breach notification rules in ways that are similar to, or even the same as, some of the revisions that were adopted in the 2016 Privacy Order, unless the revisions adopted are the same, in substance, as the 2016 Privacy Order as a whole.”

Ted Cruz wants to stop the FCC from updating data-breach notification rules Read More »

CVS, Rite Aid, Walgreens hand out medical records to cops without warrants

Amazon, cops, cvs, health, health privacy, HHS, HIPAA, law enforcement, Medical records, pharmacy, Policy, prescription drugs, rite aid, Science, Walgreens, warrant / Blake Jones / December 12, 2023

prescription for privacy —

Lawmakers want HHS to revise health privacy law to require warrants.

Beth Mole – Dec 12, 2023 8: 31 pm UTC

All of the big pharmacy chains in the US hand over sensitive medical records to law enforcement without a warrant—and some will do so without even running the requests by a legal professional, according to a congressional investigation.

The revelation raises grave medical privacy concerns, particularly in a post-Dobbs era in which many states are working to criminalize reproductive health care. Even if people in states with restrictive laws cross state lines for care, pharmacists in massive chains, such as CVS, can access records across borders.

Lawmakers noted the pharmacies’ policies for releasing medical records in a letter dated Tuesday to the Department of Health and Human Services (HHS) Secretary Xavier Becerra. The letter—signed by Sen. Ron Wyden (D-Ore.), Rep. Pramila Jayapal (D-Wash.), and Rep. Sara Jacobs (D-Calif.)—said their investigation pulled information from briefings with eight big prescription drug suppliers.

They include the seven largest pharmacy chains in the country: CVS Health, Walgreens Boots Alliance, Cigna, Optum Rx, Walmart Stores, Inc., The Kroger Company, and Rite Aid Corporation. The lawmakers also spoke with Amazon Pharmacy.

All eight of the pharmacies said they do not require law enforcement to have a warrant prior to sharing private and sensitive medical records, which can include the prescription drugs a person used or uses and their medical conditions. Instead, all the pharmacies hand over such information with nothing more than a subpoena, which can be issued by government agencies and does not require review or approval by a judge.

Three pharmacies—CVS Health, The Kroger Company, and Rite Aid Corporation—told lawmakers they didn’t even require their pharmacy staff to consult legal professionals before responding to law enforcement requests at pharmacy counters. According to the lawmakers, CVS, Kroger, and Rite Aid said that “their pharmacy staff face extreme pressure to immediately respond to law enforcement demands and, as such, the companies instruct their staff to process those requests in store.”

The rest of the pharmacies—Amazon, Cigna, Optum Rx, Walmart, and Walgreens Boots Alliance—at least require that law enforcement requests be reviewed by legal professionals before pharmacists respond. But, only Amazon said it had a policy of notifying customers of law enforcement demands for pharmacy records unless there were legal prohibitions to doing so, such as a gag order.

HIPAA and transparency

The lawmakers note that the pharmacies aren’t violating regulations under the Health Insurance Portability and Accountability Act (HIPAA). The pharmacies pointed to language in HIPAA regulations that allow health care providers, including pharmacists, to provide medical records if required by law, with subpoenas being a sufficient legal process for such a request. However, the lawmakers note that the HHS has discretion in determining the legal standard here—that is, it has the power to strengthen the regulation to require a warrant, which the lawmakers say it should do.

“We urge HHS to consider further strengthening its HIPAA regulations to more closely align them with Americans’ reasonable expectations of privacy and Constitutional principles,” the three lawmakers wrote.

They also pushed for pharmacies to do better, encouraging them to follow the lead of tech companies. “Pharmacies can and should insist on a warrant, and invite law enforcement agencies that insist on demanding patient medical records with solely a subpoena to go to court to enforce that demand. The requirement for a warrant is exactly the approach taken by tech companies to protect customer privacy.” The trio noted that Google, Microsoft, and Yahoo have since 2010 required law enforcement to have a warrant to obtain customers’ emails.

Also noting tech companies’ lead, the lawmakers encouraged pharmacies to publish annual transparency reports. In the course of the investigation, only CVS Health said it planned to do so.

“Americans deserve to have their private medical information protected at the pharmacy counter and a full picture of pharmacies’ privacy practices, so they can make informed choices about where to get their prescriptions filled,” the lawmakers wrote.

For now, HIPAA regulations grant patients the right to know who is accessing their health records. But, to do so, patients have to specifically request that information—and almost no one does that. “Last year, CVS Health, the largest pharmacy in the nation by total prescription revenue, only received a single-digit number of such consumer requests,” the lawmakers noted.

“The average American is likely unaware that this is even a problem,” the lawmakers said.

CVS, Rite Aid, Walgreens hand out medical records to cops without warrants Read More »

Tesla again threatens to sue Cybertruck buyers who try to resell the cars

Cars, Policy, Tesla Cybertruck / Ryan Harris / December 11, 2023

Do not sell happy fun truck —

Clause deleted from public version of terms is in the contract sent to buyers.

Jon Brodkin – Dec 11, 2023 10: 22 pm UTC

Tesla's boxy cybertruck displayed outdoors in New York. — Enlarge / Tesla Cybertruck displayed at Lincoln Center in New York.

Getty Images | Roman Tiraspolsky

Tesla has revived a contract clause that says the electric carmaker could sue Cybertruck buyers for $50,000 or more if they resell during their first year of ownership.

As we reported a month ago, the Cybertruck-only clause was added to the public version of Tesla’s Motor Vehicle Order Agreement Terms & Conditions and then deleted after the lawsuit threat attracted some attention. But now, people who ordered the limited launch edition “Foundation Series” Cybertruck say the order agreement they received from Tesla has the clause added back in.

The clause says Cybertruck buyers must offer the car back to Tesla at a reduced price before any attempt to resell the vehicle within one year of delivery. If Tesla declines to buy the Cybertruck back, the owner could resell it only if Tesla provides “written consent.”

“You agree that in the event you breach this provision, or Tesla has reasonable belief that you are about to breach this provision, Tesla may seek injunctive relief to prevent the transfer of title of the Vehicle or demand liquidated damages from you in the amount of $50,000 or the value received as consideration for the sale or transfer, whichever is greater. Tesla may also refuse to sell you any future vehicles,” the clause said.

Ars was contacted by one Cybertruck buyer who provided us with a copy of the order agreement he received after submitting a $122,135 order. The agreement received by this buyer contains the resale-lawsuit clause that was deleted last month from the public version of the order agreement. The public version has a rule against quick resales but not a specific lawsuit threat.

The buyer told us that he paid a $250 order fee on Friday and previously paid a $100 reservation fee. According to the order agreement, Tesla doesn’t have to refund those types of fees if a buyer cancels a purchase after submitting a completed order.

Invitations to order sent Friday

The clause’s reappearance was also confirmed Friday in a post on a Cybertruck buyers forum. People who made early Cybertruck reservations received their invitations to order the limited-availability Foundation Series edition on Friday.

As an Electrek article notes, it’s unclear whether the clause applies only to the Foundation Series version of the Cybertruck. “It might just be for the Foundation series, or might be for all Cybertrucks for a while—until it is available in more than ‘limited quantity,'” the article said.

The public version of Tesla’s Cybertruck pre-order agreement has an anti-resale clause that says the company “may unilaterally cancel any order that we believe has been made with a view toward resale of the Vehicle or that has otherwise been made in bad faith.” That version doesn’t include the lawsuit threat that was sent to buyers.

One person who posted in the Cybertruck forum was unhappy that they only received the version of the order agreement with the lawsuit warning after paying a $250 order fee. The buyer who provided us with a copy of his order agreement called it “ridiculous” that the clause “is not in bold print on the order page.”

The $120,000 Foundation Series is reportedly limited to 1,000 cars. Tesla’s website says the Cybertruck versions costing $68,890 and $96,390 will be available in 2024, and a $49,890 version will be available in 2025.

Tesla again threatens to sue Cybertruck buyers who try to resell the cars Read More »