Policy – Page 81

NYC’s government chatbot is lying about city laws and regulations

AI, government, New York City, Policy / Kris Guyer / March 29, 2024

Close enough for government work? —

You can be evicted for not paying rent, despite what the “MyCity” chatbot says.

Kyle Orland – Mar 29, 2024 8: 22 pm UTC

Enlarge / Has a government employee checked all those zeroes and ones floating above the skyline?

If you follow generative AI news at all, you’re probably familiar with LLM chatbots’ tendency to “confabulate” incorrect information while presenting that information as authoritatively true. That tendency seems poised to cause some serious problems now that a chatbot run by the New York City government is making up incorrect answers to some important questions of local law and municipal policy.

NYC’s “MyCity” ChatBot launched as a “pilot” program last October. The announcement touted the ChatBot as a way for business owners to “save … time and money by instantly providing them with actionable and trusted information from more than 2,000 NYC Business webpages and articles on topics such as compliance with codes and regulations, available business incentives, and best practices to avoid violations and fines.”

But a new report from The Markup and local nonprofit news site The City found the MyCity chatbot giving dangerously wrong information about some pretty basic city policies. To cite just one example, the bot said that NYC buildings “are not required to accept Section 8 vouchers,” when an NYC government info page says clearly that Section 8 housing subsidies are one of many lawful sources of income that landlords are required to accept without discrimination. The Markup also received incorrect information in response to chatbot queries regarding worker pay and work hour regulations, as well as industry-specific information like funeral home pricing.

Enlarge / Welcome news for people who think the rent is too damn high, courtesy of the MyCity chatbot.

Further testing from BlueSky user Kathryn Tewson shows the MyCity chatbot giving some dangerously wrong answers regarding the treatment of workplace whistleblowers, as well as some hilariously bad answers regarding the need to pay rent.

This is going to keep happening

The result isn’t too surprising if you dig into the token-based predictive models that power these kinds of chatbots. MyCity’s Microsoft Azure-powered chatbot uses a complex process of statistical associations across millions of tokens to essentially guess at the most likely next word in any given sequence, without any real understanding of the underlying information being conveyed.

That can cause problems when a single factual answer to a question might not be reflected precisely in the training data. In fact, The Markup said that at least one of its tests resulted in the correct answer on the same query about accepting Section 8 housing vouchers (even as “ten separate Markup staffers” got the incorrect answer when repeating the same question).

The MyCity Chatbot—which is prominently labeled as a “Beta” product—tells users who bother to read the warnings that it “may occasionally produce incorrect, harmful or biased content” and that users should “not rely on its responses as a substitute for professional advice.” But the page also states front and center that it is “trained to provide you official NYC Business information” and is being sold as a way “to help business owners navigate government.”

Andrew Rigie, executive director of the NYC Hospitality Alliance, told The Markup that he had encountered inaccuracies from the bot himself and had received reports of the same from at least one local business owner. But NYC Office of Technology and Innovation Spokesperson Leslie Brown told The Markup that the bot “has already provided thousands of people with timely, accurate answers” and that “we will continue to focus on upgrading this tool so that we can better support small businesses across the city.”

NYC Mayor Eric Adams touts the MyCity chatbot in an October announcement event.

The Markup’s report highlights the danger of governments and corporations rolling out chatbots to the public before their accuracy and reliability have been fully vetted. Last month, a court forced Air Canada to honor a fraudulent refund policy invented by a chatbot available on its website. A recent Washington Post report found that chatbots integrated into major tax preparation software provides “random, misleading, or inaccurate … answers” to many tax queries. And some crafty prompt engineers have reportedly been able to trick car dealership chatbots into accepting a “legally binding offer – no take backsies” for a $1 car.

These kinds of issues are already leading some companies away from more generalized LLM-powered chatbots and toward more specifically trained Retrieval-Augmented Generation models, which have been tuned only on a small set of relevant information. That kind of focus could become that much more important if the FTC is successful in its efforts to make chatbots liable for “false, misleading, or disparaging” information.

NYC’s government chatbot is lying about city laws and regulations Read More »

Jails banned visits in “quid pro quo” with prison phone companies, lawsuits say

Global Tel*Link, Policy, prison phone, Securus Technologies / Kris Guyer / March 29, 2024

The bars of a jail cell are pictured along with a man's hand turning a key in the lock of the cell door. — Getty Images | Charles O’Rear

Two lawsuits filed by a civil rights group allege that county jails in Michigan banned in-person visits in order to maximize revenue from voice and video calls as part of a “quid pro quo kickback scheme” with prison phone companies.

Civil Rights Corps filed the lawsuits on March 15 against the county governments, two county sheriffs, and two prison phone companies. The suits filed in county courts seek class-action status on behalf of people unable to visit family members detained in the local jails, including children who have been unable to visit their parents.

Defendants in one lawsuit include St. Clair County Sheriff Mat King, prison phone company Securus Technologies, and Securus owner Platinum Equity. In the other lawsuit, defendants include Genesee County Sheriff Christopher Swanson and prison phone company ViaPath Technologies. ViaPath was formerly called Global Tel*Link Corporation (GTL), and the lawsuit primarily refers to the company as GTL.

Each year, thousands of people spend months in the county jails, the lawsuit said. Many of the detainees have not been convicted of any crime and are awaiting trial; if they are convicted and receive long sentences, they are transferred to the Michigan Department of Corrections.

The named plaintiffs in both cases include family members, including children identified by their initials.

“Hundreds of jails” eliminated visits

The Michigan counties are far from alone in implementing visitation bans, Civil Rights Corps said in a lawsuit announcement. “Across the United States, hundreds of jails have eliminated in-person family visits over the last decade,” the group said, adding:

Why has this happened? The answer highlights a profound flaw in how decisions too often get made in our legal system: for-profit jail telecom companies realized that they could earn more profit from phone and video calls if jails eliminated free in-person visits for families. So the companies offered sheriffs and county jails across the country a deal: if you eliminate family visits, we’ll give you a cut of the increased profits from the larger number of calls. This led to a wave across the country, as local jails sought to supplement their budgets with hundreds of millions of dollars in cash from some of the poorest families in our society.

St. Clair County implemented its family visitation ban in September 2017, “prohibiting people from visiting their family members detained inside the county jail,” Civil Rights Corps alleged. This “decision was part of a quid pro quo kickback scheme with Securus Technologies, a for-profit company that contracts with jails to charge the families of incarcerated persons exorbitant rates to communicate with one another through ‘services’ such as low-quality phone and video calls,” the lawsuit said.

Under the contract, “Securus pays the County 50 percent of the $12.99 price tag for every 20-minute video call and 78 percent of the $0.21 per minute cost of every phone call,” the lawsuit said. The contract has “a guarantee that Securus would pay the County at least $190,000 each year,” the St. Clair County lawsuit said.

Jails banned visits in “quid pro quo” with prison phone companies, lawsuits say Read More »

Biden orders every US agency to appoint a chief AI officer

AI, AI bias, AI harms, AI risks, Artificial Intelligence, biden administration, chief AI officers, Policy / Kris Guyer / March 28, 2024

Mission control —

Federal agencies rush to appoint chief AI officers with “significant expertise.”

Ashley Belanger – Mar 28, 2024 5: 52 pm UTC

The White House has announced the “first government-wide policy to mitigate risks of artificial intelligence (AI) and harness its benefits.” To coordinate these efforts, every federal agency must appoint a chief AI officer with “significant expertise in AI.”

Some agencies have already appointed chief AI officers, but any agency that has not must appoint a senior official over the next 60 days. If an official already appointed as a chief AI officer does not have the necessary authority to coordinate AI use in the agency, they must be granted additional authority or else a new chief AI officer must be named.

Ideal candidates, the White House recommended, might include chief information officers, chief data officers, or chief technology officers, the Office of Management and Budget (OMB) policy said.

As chief AI officers, appointees will serve as senior advisers on AI initiatives, monitoring and inventorying all agency uses of AI. They must conduct risk assessments to consider whether any AI uses are impacting “safety, security, civil rights, civil liberties, privacy, democratic values, human rights, equal opportunities, worker well-being, access to critical resources and services, agency trust and credibility, and market competition,” OMB said.

Perhaps most urgently, by December 1, the officers must correct all non-compliant AI uses in government, unless an extension of up to one year is granted.

The chief AI officers will seemingly enjoy a lot of power and oversight over how the government uses AI. It’s up to the chief AI officers to develop a plan to comply with minimum safety standards and to work with chief financial and human resource officers to develop the necessary budgets and workforces to use AI to further each agency’s mission and ensure “equitable outcomes,” OMB said. Here’s a brief summary of OMB’s ideals:

Agencies are encouraged to prioritize AI development and adoption for the public good and where the technology can be helpful in understanding and tackling large societal challenges, such as using AI to improve the accessibility of government services, reduce food insecurity, address the climate crisis, improve public health, advance equitable outcomes, protect democracy and human rights, and grow economic competitiveness in a way that benefits people across the United States.

Among the chief AI officer’s primary responsibilities is determining what AI uses might impact the safety or rights of US citizens. They’ll do this by assessing AI impacts, conducting real-world tests, independently evaluating AI, regularly evaluating risks, properly training staff, providing additional human oversight where necessary, and giving public notice of any AI use that could have a “significant impact on rights or safety,” OMB said.

OMB breaks down several AI uses that could impact safety, including controlling “safety-critical functions” within everything from emergency services to food-safety mechanisms to systems controlling nuclear reactors. Using AI to maintain election integrity could be safety-impacting, too, as could using AI to move industrial waste, control health insurance costs, or detect the “presence of dangerous weapons.”

Uses of AI presumed to be rights-impacting include censoring protected speech and a wide range of law enforcement efforts, such as predicting crimes, sketching faces, or using license plate readers to track personal vehicles in public spaces. Other rights-impacting AI uses include “risk assessments related to immigration,” “replicating a person’s likeness or voice without express consent,” or detecting students cheating.

Chief AI officers will ultimately decide if any AI use is safety- or rights-impacting and must adhere to OMB’s minimum standards for responsible AI use. Once a determination is made, the officers will “centrally track” the determinations, informing OMB of any major changes to “conditions or context in which the AI is used.” The officers will also regularly convene “a new Chief AI Officer Council to coordinate” efforts and share innovations government-wide.

As agencies advance AI uses—which the White House says is critical to “strengthen AI safety and security, protect Americans’ privacy, advance equity and civil rights, stand up for consumers and workers, promote innovation and competition, advance American leadership around the world, and more”—chief AI officers will become the public-facing figures accountable for decisions made. In that role, the officer must consult with the public and incorporate “feedback from affected communities,” notify “negatively affected individuals” of new AI uses, and maintain options to opt-out of “AI-enabled decisions,” OMB said.

However, OMB noted that chief AI officers also have the power to waive opt-out options “if they can demonstrate that a human alternative would result in a service that is less fair (e.g., produces a disparate impact on protected classes) or if an opt-out would impose undue hardship on the agency.”

Biden orders every US agency to appoint a chief AI officer Read More »

Starlink mobile plans hit snag as FCC dismisses SpaceX spectrum application

Policy, spacex starlink, starlink fcc / Kris Guyer / March 27, 2024

Snow and ice cover part of a Starlink satellite dish. — Enlarge / A Starlink user terminal during winter.

Getty Images | AntaresNS

Starlink’s mobile ambitions were dealt at least a temporary blow yesterday when the Federal Communications Commission dismissed SpaceX’s application to use several spectrum bands for mobile service.

SpaceX is seeking approval to use up to 7,500 second-generation Starlink satellites with spectrum in the 1.6 GHz, 2 GHz, and 2.4 GHz bands. SpaceX could still end up getting what it wants but will have to go through new rulemaking processes in which the FCC will evaluate whether the spectrum bands can handle the system without affecting existing users.

The FCC Space Bureau’s ruling dismissed the SpaceX application yesterday as “unacceptable for filing.” The application was filed over a year ago.

The FCC said the SpaceX requests “do not substantially comply with Commission requirements established in rulemaking proceedings which determined that the 1.6/2.4 GHz and 2 GHz bands are not available for additional MSS [mobile-satellite service] applications.”

But the FCC yesterday also issued two public notices seeking comment on SpaceX petitions to revise the commission’s spectrum-sharing rules for the bands. Dish Network and Globalstar oppose the SpaceX requests, and SpaceX will have to prove to the FCC that its plan won’t cause harmful interference to other systems.

T-Mobile deal still on, but SpaceX wants more capacity

The FCC order won’t stop SpaceX’s partnership with T-Mobile, which uses T-Mobile’s licensed spectrum in the 1.9 GHz band. In January, Starlink demonstrated the first text messages sent between T-Mobile phones via one of Starlink’s low-Earth orbit satellites. Texting service for T-Mobile users is expected sometime during 2024 with voice and data service beginning later.

But SpaceX wants to use more spectrum bands to increase capacity in the US and elsewhere. Space has Starlink partnerships with several carriers outside the US.

SpaceX filed its application in February 2023. “Granting this application will enable SpaceX to augment its MSS capabilities and leverage its next-generation satellite constellation to provide increased capacity, reduced latency, and broader service coverage for mobile users across the United States and the world, including those users underserved or unserved by existing networks,” the application said.

Dish Network owner EchoStar is angry that the FCC is still entertaining SpaceX’s request for the 2 GHz band. “The FCC should immediately dismiss SpaceX’s petition for rulemaking without seeking comment, because the mere action of seeking comment would provide it with undeserved credibility and threaten the certainty that has allowed EchoStar to innovate in this band leading to significant public interest benefits,” the company told the FCC yesterday.

Starlink mobile plans hit snag as FCC dismisses SpaceX spectrum application Read More »

Facebook secretly spied on Snapchat usage to confuse advertisers, court docs say

Amazon, anticompetitive behavior, Antitrust law, facebook, Google, Instagram, mark zuckerberg, Meta, online advertising, Policy, Snapchat, social media ads, youtube / Kris Guyer / March 27, 2024

“I can’t think of a good argument for why this is okay” —

Zuckerberg told execs to “figure out” how to spy on encrypted Snapchat traffic.

Ashley Belanger – Mar 27, 2024 8: 25 pm UTC

Unsealed court documents have revealed more details about a secret Facebook project initially called “Ghostbusters,” designed to sneakily access encrypted Snapchat usage data to give Facebook a leg up on its rival, just when Snapchat was experiencing rapid growth in 2016.

The documents were filed in a class-action lawsuit from consumers and advertisers, accusing Meta of anticompetitive behavior that blocks rivals from competing in the social media ads market.

“Whenever someone asks a question about Snapchat, the answer is usually that because their traffic is encrypted, we have no analytics about them,” Facebook CEO Mark Zuckerberg (who has since rebranded his company as Meta) wrote in a 2016 email to Javier Olivan.

“Given how quickly they’re growing, it seems important to figure out a new way to get reliable analytics about them,” Zuckerberg continued. “Perhaps we need to do panels or write custom software. You should figure out how to do this.”

At the time, Olivan was Facebook’s head of growth, but now he’s Meta’s chief operating officer. He responded to Zuckerberg’s email saying that he would have the team from Onavo—a controversial traffic-analysis app acquired by Facebook in 2013—look into it.

Olivan told the Onavo team that he needed “out of the box thinking” to satisfy Zuckerberg’s request. He “suggested potentially paying users to ‘let us install a really heavy piece of software'” to intercept users’ Snapchat data, a court document shows.

What the Onavo team eventually came up with was a project internally known as “Ghostbusters,” an obvious reference to Snapchat’s logo featuring a white ghost. Later, as the project grew to include other Facebook rivals, including YouTube and Amazon, the project was called the “In-App Action Panel” (IAAP).

The IAAP program’s purpose was to gather granular insights into users’ engagement with rival apps to help Facebook develop products as needed to stay ahead of competitors. For example, two months after Zuckerberg’s 2016 email, Meta launched Stories, a Snapchat copycat feature, on Instagram, which the Motley Fool noted rapidly became a key ad revenue source for Meta.

In an email to Olivan, the Onavo team described the “technical solution” devised to help Zuckerberg figure out how to get reliable analytics about Snapchat users. It worked by “develop[ing] ‘kits’ that can be installed on iOS and Android that intercept traffic for specific sub-domains, allowing us to read what would otherwise be encrypted traffic so we can measure in-app usage,” the Onavo team said.

Olivan was told that these so-called “kits” used a “man-in-the-middle” attack typically employed by hackers to secretly intercept data passed between two parties. Users were recruited by third parties who distributed the kits “under their own branding” so that they wouldn’t connect the kits to Onavo unless they used a specialized tool like Wireshark to analyze the kits. TechCrunch reported in 2019 that sometimes teens were paid to install these kits. After that report, Facebook promptly shut down the project.

This “man-in-the-middle” tactic, consumers and advertisers suing Meta have alleged, “was not merely anticompetitive, but criminal,” seemingly violating the Wiretap Act. It was used to snoop on Snapchat starting in 2016, on YouTube from 2017 to 2018, and on Amazon in 2018, relying on creating “fake digital certificates to impersonate trusted Snapchat, YouTube, and Amazon analytics servers to redirect and decrypt secure traffic from those apps for Facebook’s strategic analysis.”

Ars could not reach Snapchat, Google, or Amazon for comment.

Facebook allegedly sought to confuse advertisers

Not everyone at Facebook supported the IAAP program. “The company’s highest-level engineering executives thought the IAAP Program was a legal, technical, and security nightmare,” another court document said.

Pedro Canahuati, then-head of security engineering, warned that incentivizing users to install the kits did not necessarily mean that users understood what they were consenting to.

“I can’t think of a good argument for why this is okay,” Canahuati said. “No security person is ever comfortable with this, no matter what consent we get from the general public. The general public just doesn’t know how this stuff works.”

Mike Schroepfer, then-chief technology officer, argued that Facebook wouldn’t want rivals to employ a similar program analyzing their encrypted user data.

“If we ever found out that someone had figured out a way to break encryption on [WhatsApp] we would be really upset,” Schroepfer said.

While the unsealed emails detailing the project have recently raised eyebrows, Meta’s spokesperson told Ars that “there is nothing new here—this issue was reported on years ago. The plaintiffs’ claims are baseless and completely irrelevant to the case.”

According to Business Insider, advertisers suing said that Meta never disclosed its use of Onavo “kits” to “intercept rivals’ analytics traffic.” This is seemingly relevant to their case alleging anticompetitive behavior in the social media ads market, because Facebook’s conduct, allegedly breaking wiretapping laws, afforded Facebook an opportunity to raise its ad rates “beyond what it could have charged in a competitive market.”

Since the documents were unsealed, Meta has responded with a court filing that said: “Snapchat’s own witness on advertising confirmed that Snap cannot ‘identify a single ad sale that [it] lost from Meta’s use of user research products,’ does not know whether other competitors collected similar information, and does not know whether any of Meta’s research provided Meta with a competitive advantage.”

This conflicts with testimony from a Snapchat executive, who alleged that the project “hamper[ed] Snap’s ability to sell ads” by causing “advertisers to not have a clear narrative differentiating Snapchat from Facebook and Instagram.” Both internally and externally, “the intelligence Meta gleaned from this project was described” as “devastating to Snapchat’s ads business,” a court filing said.

Facebook secretly spied on Snapchat usage to confuse advertisers, court docs say Read More »

SCOTUS mifepristone case: Justices focus on anti-abortion groups’ legal standing

Abortion, alito, barrett, clarence thomas, comstock, drug approval, fda, gorsuch, kagan, ketanji brown jackson, medication abortion, mifepristone, Policy, Science, SCOTUS / Paul Patrick / March 26, 2024

Demonstrators participate in an abortion-rights rally outside the Supreme Court as the justices of the court hear oral arguments in the case of the <em>US Food and Drug Administration v. Alliance for Hippocratic Medicine</em> on March 26, 2024 in Washington, DC.” src=”https://cdn.arstechnica.net/wp-content/uploads/2024/03/GettyImages-2115237711-800×533.jpeg”></img><figcaption>
<p><a data-height=

The US Supreme Court on Tuesday heard arguments in a case seeking to limit access to the abortion and miscarriage drug mifepristone, with a majority of justices expressing skepticism that the anti-abortion groups that brought the case have the legal standing to do so.

The case threatens to dramatically alter access to a drug that has been safely used for decades and, according to the Guttmacher Institute, was used in 63 percent of abortions documented in the health care system in 2023. But, it also has sweeping implications for the Food and Drug Administration’s authority over drugs, marking the first time that courts have second-guessed the agency’s expert scientific analysis and moved to restrict access to an FDA-approved drug.

As such, the case has rattled health experts, reproductive health care advocates, the FDA, and the pharmaceutical industry alike. But, based on the line of questioning in today’s oral arguments, they have reason to breathe a sigh of relief.

Standing

The case was initially filed in 2022 by a group of anti-abortion organizations led by the Alliance for Hippocratic Medicine. They collectively claimed that the FDA’s approval of mifepristone in 2000 was unlawful, as were FDA actions in 2016 and 2021 that eased access to the drug, allowing for it to be prescribed via telemedicine and dispensed through the mail. The anti-abortion groups justified bringing the lawsuit by claiming that the doctors in their ranks are harmed by the FDA’s actions because they are forced to treat girls and women seeking emergency medical care after taking mifepristone and experiencing complications.

The FDA and numerous medical organizations have emphatically noted that mifepristone is extremely safe and the complications the lawsuit references are exceedingly rare. Serious side effects occur in less than 1 percent of patients, and major adverse events, including infection, blood loss, or hospitalization, occur in less than 0.3 percent, according to the American College of Obstetricians and Gynecologists. Deaths are almost non-existent.

Still, a conservative federal judge in Texas sided with the anti-abortion groups last year, revoking the FDA’s 2000 approval. A conservative panel of judges for the Court of Appeals for the 5th Circuit in New Orleans then partially overturned the ruling, undoing the lower court’s ruling on the 2000 approval, allowing the FDA’s approval to stand, but still finding the FDA’s 2016 and 2021 actions unlawful. The ruling was frozen until the Supreme Court weighed in.

Today, many of the Supreme Court Justices went back to the very beginning: the claimed scenario that the plaintiff doctors have been or will imminently be harmed by the FDA’s actions. At the outset of the hearings, Solicitor General Elizabeth Prelogar argued that the plaintiffs had not been harmed, and, even if they were, they already had federal protections and recourse. Any doctor who consciously objects to caring for a patient who has had an abortion already has federal protections that prevent them from being forced to provide that care, Prelogar argued. As such, hospitals have legal obligations and have set up contingency and staffing plans to prevent violating those doctors’ federal conscious objection protections.

SCOTUS mifepristone case: Justices focus on anti-abortion groups’ legal standing Read More »

Missouri AG sues Media Matters over its X research, demands donor names

elon musk media matters, missouri media matters, Policy / Paul Patrick / March 26, 2024

Getty Images | NurPhoto

Missouri Attorney General Andrew Bailey yesterday sued Media Matters in an attempt to protect Elon Musk and X from the nonprofit watchdog group’s investigations into hate speech on the social network. Bailey’s lawsuit claims that “Media Matters has used fraud to solicit donations from Missourians in order to trick advertisers into removing their advertisements from X, formerly Twitter, one of the last platforms dedicated to free speech in America.”

Bailey didn’t provide much detail on the alleged fraud but claimed that Media Matters is guilty of “fraudulent manipulation of data on X.com.” That’s apparently a reference to Media Matters reporting that X placed ads for major brands next to posts touting Hitler and Nazis. X has accused Media Matters of manipulating the site’s algorithm by endlessly scrolling and refreshing.

Bailey yesterday issued an investigative demand seeking names and addresses of all Media Matters donors who live in Missouri and a range of internal communications and documents regarding the group’s research on Musk and X. Bailey anticipates that Media Matters won’t provide the requested materials, so he filed the lawsuit asking Cole County Circuit Court for an order to enforce the investigative demand.

“Because Media Matters has refused such efforts in other states and made clear that it will refuse any such efforts, the Attorney General seeks an order… compelling Media Matters to comply with the CID [Civil Investigative Demand] within 20 days,” the lawsuit said.

Media Matters slams Musk and Missouri AG

Media Matters, which is separately fighting similar demands made by Texas, responded to Missouri’s legal action in a statement provided to Ars today.

“Far from the free speech advocate he claims to be, Elon Musk has actually intensified his efforts to undermine free speech by enlisting Republican attorneys general across the country to initiate meritless, expensive, and harassing investigations against Media Matters in an attempt to punish critics,” Media Matters President Angelo Carusone said. “This Missouri investigation is the latest in a transparent endeavor to squelch the First Amendment rights of researchers and reporters; it will have a chilling effect on news reporters.”

Musk thanked Bailey for filing the lawsuit in a post that said, “Media Matters is doing everything it can to undermine the First Amendment. Truly an evil organization.”

Bailey is seeking the names and addresses of all Media Matters donors from Missouri since January 1, 2023, and the amounts of each donation. He wants all promotional or marketing material sent to potential donors and documents showing how the donations were used.

Ads next to pro-Nazi content

Several of Bailey’s demands relate to the Media Matters article titled, “As Musk endorses antisemitic conspiracy theory, X has been placing ads for Apple, Bravo, IBM, Oracle, and Xfinity next to pro-Nazi content.” Bailey wants all “documents related to the article, or to the events described in the article.”

The Media Matters article displayed images of advertisements next to pro-Nazi posts. Musk previously sued Media Matters over the article, claiming the group “manipulated the algorithms governing the user experience on X to bypass safeguards and create images of X’s largest advertisers’ paid posts adjacent to racist, incendiary content.”

X said Media Matters did this by “endlessly scrolling and refreshing its unrepresentative, hand-selected feed, generating between 13 and 15 times more advertisements per hour than viewed by the average X user repeating this inauthentic activity until it finally received pages containing the result it wanted: controversial content next to X’s largest advertisers’ paid posts.”

X also sued the Center for Countering Digital Hate, but the lawsuit was thrown out by a federal judge yesterday.

Missouri AG sues Media Matters over its X research, demands donor names Read More »

Florida braces for lawsuits over law banning kids from social media

age verification, data privacy, Florida, online child safety, Policy, ron desantis / Paul Patrick / March 26, 2024

On Monday, Florida became the first state to ban kids under 14 from social media without parental permission. It appears likely that the law—considered one of the most restrictive in the US—will face significant legal challenges, however, before taking effect on January 1.

Under HB 3, apps like Instagram, Snapchat, or TikTok would need to verify the ages of users, then delete any accounts for users under 14 when parental consent is not granted. Companies that “knowingly or recklessly” fail to block underage users risk fines of up to $10,000 in damages to anyone suing on behalf of child users. They could also be liable for up to $50,000 per violation in civil penalties.

In a statement, Florida governor Ron DeSantis said the “landmark law” gives “parents a greater ability to protect their children” from a variety of social media harm. Florida House Speaker Paul Renner, who spearheaded the law, explained some of that harm, saying that passing HB 3 was critical because “the Internet has become a dark alley for our children where predators target them and dangerous social media leads to higher rates of depression, self-harm, and even suicide.”

But tech groups critical of the law have suggested that they are already considering suing to block it from taking effect.

In a statement provided to Ars, a nonprofit opposing the law, the Computer & Communications Industry Association (CCIA) said that while CCIA “supports enhanced privacy protections for younger users online,” it is concerned that “any commercially available age verification method that may be used by a covered platform carries serious privacy and security concerns for users while also infringing upon their First Amendment protections to speak anonymously.”

“This law could create substantial obstacles for young people seeking access to online information, a right afforded to all Americans regardless of age,” Khara Boender, CCIA’s state policy director, warned. “It’s foreseeable that this legislation may face legal opposition similar to challenges seen in other states.”

Carl Szabo, vice president and general counsel for Netchoice—a trade association with members including Meta, TikTok, and Snap—went even further, warning that Florida’s “unconstitutional law will protect exactly zero Floridians.”

Szabo suggested that there are “better ways to keep Floridians, their families, and their data safe and secure online without violating their freedoms.” Democratic state house representative Anna Eskamani opposed the bill, arguing that “instead of banning social media access, it would be better to ensure improved parental oversight tools, improved access to data to stop bad actors, alongside major investments in Florida’s mental health systems and programs.”

Netchoice expressed “disappointment” that DeSantis agreed to sign a law requiring an “ID for the Internet” after “his staunch opposition to this idea both on the campaign trail” and when vetoing a prior version of the bill.

“HB 3 in effect will impose an ‘ID for the Internet’ on any Floridian who wants to use an online service—no matter their age,” Szabo said, warning of invasive data collection needed to verify that a user is under 14 or a parent or guardian of a child under 14.

“This level of data collection will put Floridians’ privacy and security at risk, and it violates their constitutional rights,” Szabo said, noting that in court rulings in Arkansas, California, and Ohio over similar laws, “each of the judges noted the similar laws’ constitutional and privacy problems.”

Florida braces for lawsuits over law banning kids from social media Read More »

Justice Department indicts 7 accused in 14-year hack campaign by Chinese gov

apt31, Biz & IT, hacking, people's republic of china, Policy, Security, zirconium / Kris Guyer / March 25, 2024

INDICTED —

Hacks allegedly targeted US officials and politicians, their spouses and dozens of companies.

Dan Goodin – Mar 25, 2024 8: 20 pm UTC

The US Justice Department on Monday unsealed an indictment charging seven men with hacking or attempting to hack dozens of US companies in a 14-year campaign furthering an economic espionage and foreign intelligence gathering by the Chinese government.

All seven defendants, federal prosecutors alleged, were associated with Wuhan Xiaoruizhi Science & Technology Co., Ltd. a front company created by the Hubei State Security Department, an outpost of the Ministry of State Security located in Wuhan province. The MSS, in turn, has funded an advanced persistent threat group tracked under names including APT31, Zirconium Violet Typhoon, Judgment Panda, and Altaire.

Relentless 14-year campaign

“Since at least 2010, the defendants … engaged in computer network intrusion activity on behalf of the HSSD targeting numerous US government officials, various US economic and defense industries and a variety of private industry officials, foreign democracy activists, academics and parliamentarians in response to geopolitical events affecting the PRC,” federal prosecutors alleged. “These computer network intrusion activities resulted in the confirmed and potential compromise of work and personal email accounts, cloud storage accounts and telephone call records belonging to millions of Americans, including at least some information that could be released in support of malign influence targeting democratic processes and institutions, and economic plans, intellectual property, and trade secrets belonging to American businesses, and contributed to the estimated billions of dollars lost every year as a result of the PRC’s state-sponsored apparatus to transfer US technology to the PRC.”

The relentless, 14-year campaign targeted thousands of individuals and dozens of companies through the use of zero-day attacks, website vulnerability exploitation, and the targeting of home routers and personal devices of high-ranking US government officials and politicians and election campaign staff from both major US political parties.

“The targeted US government officials included individuals working in the White House, at the Departments of Justice, Commerce, Treasury and State, and US Senators and Representatives of both political parties,” Justice Department officials said. “The defendants and others in the APT31 Group targeted these individuals at both professional and personal email addresses. Additionally in some cases, the defendants also targeted victims’ spouses, including the spouses of a high-ranking Department of Justice official, high-ranking White House officials and multiple United States Senators. Targets also included election campaign staff from both major US political parties in advance of the 2020 election.”

One technique the defendants allegedly used was the sending of emails to journalists, political officials, and companies. The messages, which were made to appear as originating from news outlets or journalists, contained hidden tracking links, which, when activated, gave APT31 members information about the locations, IP addresses, network schematics, and specific devices of the targets for use in follow-on attacks. Some of the targets of these emails included foreign government officials who were part of the Inter-Parliamentary Alliance on China, a group formed after the 1989 Tiananmen Square massacre that’s critical of the Chinese government; every European Union member of that’s a member of that group; and 43 UK parliamentary accounts part of the group or critical of the People’s Republic of China.

APT31 used a variety of methods to infect networks of interest with custom malware such as RAWDOOR, Trochilus, EvilOSX, DropDoor/DropCa, and later the widely available Cobalt Strike Beacon security testing tool. In late 2016, the hacking group exploited what was then a zero-day vulnerability in unnamed software to gain access to an unidentified defense contractor. In their indictment, prosecutors wrote:

Using the zero-day privilege escalation exploit, the Conspirators first obtained administrator access to a subsidiary’s network before ultimately pivoting into the Defense Contractor’s core corporate network,” prosecutors wrote in the indictment. “The Conspirators used a SQL injection, in which they entered malicious code into a web form input box to gain access to information that was not intended to be displayed, to create an account on the subsidiary’s network with the username “testdew23.” The Conspirators used malicious software to grant administrator privileges to the “testdew23” user account. Next, the Conspirators uploaded a web shell, or a script that enables remote administration of the computer, named “Welcome to Chrome,” onto the subsidiary’s web server. Thereafter, the Conspirators used the web shell to upload and execute at least two malicious files on the web server, which were configured to open a connection between the victim’s network and computers outside that network that were controlled by the Conspirators. Through this method, the Conspirators successfully gained unauthorized access to the Defense Contractor’s network.

Other APT31 targets include military contractors and companies in the aerospace, IT services, software, telecommunications, manufacturing, and financial services industries. APT31 has long been known to target not only individuals and entities with information of primary interest but also companies or services that the primary targets rely on. Primary targets were dissidents and critics of the PRC and Western companies in possession of technical information of value to the PRC.

Prosecutors said targets successfully hacked by APT31 include:

a cleared defense contractor based in Oklahoma that designed and manufactured military flight simulators for the US military
a cleared aerospace and defense contractor based in Tennessee
an Alabama-based research corporation in the aerospace and defense industries
a Maryland-based professional support services company that serviced the Department of Defense and other government agencies
a leading American manufacturer of software and computer services based in California
a leading global provider of wireless technology based in Illinois; a technology company based in New York
a software company servicing the industrial controls industry based in California
an IT consulting company based in California; an IT services and spatial processing company based in Colorado
a multifactor authentication company; an American trade association
multiple information technology training and support companies
a leading provider of 5G network equipment in the United States
an IT solutions and 5G integration service company based in Idaho
a telecommunications company based in Illinois
a voice technology company headquartered in California;
a prominent trade organization with offices in New York and elsewhere
a manufacturing association based in Washington, DC
a steel company
an apparel company based in New York
an engineering company based in California
an energy company based in Texas
a finance company headquartered in New York
A US multi-national management consulting company with offices in Washington, DC, and elsewhere
a financial ratings company based in New York
an advertising agency based in New York
a consulting company based in Virginia;
multiple global law firms based in New York and throughout the United States
a law firm software provider
a machine learning laboratory based in Virginia
a university based in California
multiple research hospitals and institutes located in New York and Massachusetts
an international non-profit organization headquartered in Washington, DC.

The defendants are:

Ni Gaobin (倪高彬), age 38
Weng Ming (翁明), 37
Cheng Feng (程锋), 34
Peng Yaowen (彭耀文), 38
Sun Xiaohui (孙小辉), 38
Xiong Wang (熊旺), 35
Zhao Guangzong (赵光宗), 38

The men were charged with conspiracy to commit computer intrusions and conspiracy to commit wire fraud. While none of the men are in US custody or likely to face prosecution, the US Department of Treasury on Monday sanctioned Wuhan Xiaoruizhi Science and Technology Company, Limited. The department also designated Zhao Guangzong and Ni Gaobin for their roles in hacks targeting US critical infrastructure.

“As a result of today’s action, all property and interests in property of the designated persons and entity described above that are in the United States or in the possession or control of US persons are blocked and must be reported to OFAC,” Treasury officials wrote. “In addition, any entities that are owned, directly or indirectly, individually or in the aggregate, 50 percent or more by one or more blocked persons are also blocked. Unless authorized by a general or specific license issued by OFAC, or exempt, OFAC’s regulations generally prohibit all transactions by US persons or within (or transiting) the United States that involve any property or interests in property of designated or otherwise blocked persons.”

The US State Department is offering $10 million for information leading to the identification or location of any of the defendants or others associated with the campaign.

Justice Department indicts 7 accused in 14-year hack campaign by Chinese gov Read More »

Lawsuit from Elon Musk’s X against anti-hate speech group dismissed by US judge

center for countering digital hate, elon musk twitter, musk twitter lawsuit, Policy, syndication / Kris Guyer / March 25, 2024

free speech —

Ruling says case appeared to be directed at “punishing” speech from nonprofit.

Hannah Murphy, Financial Times – Mar 25, 2024 6: 43 pm UTC

Getty Images | Dan Kitwood

A US judge has struck down a lawsuit brought by X against a nonprofit group that researched toxic content on the social media platform, finding the Elon Musk-owned company’s case appeared to be an attempt at “punishing” the group for exercising free speech.

The Center for Countering Digital Hate had sought to dismiss the case from X, which alleged the nonprofit unlawfully accessed and scraped X data for its studies. The CCDH found a rise in hate speech and misinformation on the platform. X had also alleged the group “cherry-picked” from posts on the platform to conduct a “scare campaign” to drive away advertisers, costing it tens of millions of dollars.

In a stinging ruling, US judge Charles Breyer in California granted the motion. “Sometimes it is unclear what is driving a litigation, and only by reading between the lines of a complaint can one attempt to surmise a plaintiff’s true purpose. Other times, a complaint is so unabashedly and vociferously about one thing that there can be no mistaking that purpose. This case represents the latter circumstance. This case is about punishing the defendants for their speech,” he wrote in the decision.

The judge found that on top of punishing the CCDH for a report criticizing the company, X appeared to have filed the suit “perhaps in order to dissuade others who might wish to engage in such criticism.”

The lawsuit is just one of several bitter disputes between Musk, a self-declared “free speech absolutist,” and civil rights groups and academics whose research argues the platform has not been adequately policed following the billionaire’s takeover in late 2022.

It comes as X’s revenue has fallen after brands pulled away over Musk’s decision to relax moderation on the platform. He, in turn, has lashed out at advertisers, saying last year that those who have left should “go fuck themselves” despite the company struggling financially.

CCDH chief executive Imran Ahmed said following the ruling: “The courts today have affirmed our fundamental right to research, to speak, to advocate, and to hold accountable social media companies for decisions they make behind closed doors that affect our kids, our democracy, and our fundamental human rights and civil liberties.”

He described the suit as “Elon Musk’s loud, hypocritical campaign of harassment, abuse, and lawfare designed to avoid taking responsibility for his own decisions.”

In a statement on X, the company said it disagreed with the court’s decisions and “plans to appeal.” Musk did not immediately comment on the case but last week wrote on the platform that the CCDH was a “truly evil organization that just wants to destroy the first amendment under the guise of doing good!”

Lawsuit from Elon Musk’s X against anti-hate speech group dismissed by US judge Read More »

Apple, Google, and Meta are failing DMA compliance, EU suspects

alphabet, App Store, Apple, Apple App Store, facebook, Facebook subscription, Google, Google Play Store, google search, Instagram, instagram subscription, Meta, Policy / Kris Guyer / March 25, 2024

Enlarge / EU Commissioner for Internal Market Thierry Breton talks to media about non-compliance investigations against Google, Apple, and Meta under the Digital Markets Act (DMA).

Not even three weeks after the European Union’s Digital Markets Act (DMA) took effect, the European Commission (EC) announced Monday that it is already probing three out of six gatekeepers—Apple, Google, and Meta—for suspected non-compliance.

Apple will need to prove that changes to its app store and existing user options to swap out default settings easily are sufficient to comply with the DMA.

Similarly, Google’s app store rules will be probed, as well as any potentially shady practices unfairly preferencing its own services—like Google Shopping and Hotels—in search results.

Finally, Meta’s “Subscription for No Ads” option—allowing Facebook and Instagram users to opt out of personalized ad targeting for a monthly fee—may not fly under the DMA. Even if Meta follows through on its recent offer to slash these fees by nearly 50 percent, the model could be deemed non-compliant.

“The DMA is very clear: gatekeepers must obtain users’ consent to use their personal data across different services,” the EC’s commissioner for internal market, Thierry Breton, said Monday. “And this consent must be free!”

In total, the EC announced five investigations: two against Apple, two against Google, and one against Meta.

“We suspect that the suggested solutions put forward by the three companies do not fully comply with the DMA,” antitrust chief Margrethe Vestager said, ordering companies to “retain certain documents” viewed as critical to assessing evidence in the probe.

The EC’s investigations are expected to conclude within one year. If tech companies are found non-compliant, they risk fines of up to 10 percent of total worldwide turnover. Any repeat violations could spike fines to 20 percent.

“Moreover, in case of systematic infringements, the Commission may also adopt additional remedies, such as obliging a gatekeeper to sell a business or parts of it or banning the gatekeeper from acquisitions of additional services related to the systemic non-compliance,” the EC’s announcement said.

In addition to probes into Apple, Google, and Meta, the EC will scrutinize Apple’s fee structure for app store alternatives and send retention orders to Amazon and Microsoft. That makes ByteDance the only gatekeeper so far to escape “investigatory steps” as the EU fights to enforce the DMA’s strict standards. (ByteDance continues to contest its gatekeeper status.)

“These are the cases where we already have concrete evidence of possible non-compliance,” Breton said. “And this in less than 20 days of DMA implementation. But our monitoring and investigative work of course doesn’t stop here,” Breton said. “We may have to open other non-compliance cases soon.

Google and Apple have both issued statements defending their current plans for DMA compliance.

“To comply with the Digital Markets Act, we have made significant changes to the way our services operate in Europe,” Google’s competition director Oliver Bethell told Ars, promising to “continue to defend our approach in the coming months.”

“We’re confident our plan complies with the DMA, and we’ll continue to constructively engage with the European Commission as they conduct their investigations,” Apple’s spokesperson told Ars. “Teams across Apple have created a wide range of new developer capabilities, features, and tools to comply with the regulation. At the same time, we’ve introduced protections to help reduce new risks to the privacy, quality, and security of our EU users’ experience. Throughout, we’ve demonstrated flexibility and responsiveness to the European Commission and developers, listening and incorporating their feedback.”

A Meta spokesperson told Ars that Meta “designed Subscription for No Ads to address several overlapping regulatory obligations, including the DMA,” promising to comply with the DMA while arguing that “subscriptions as an alternative to advertising are a well-established business model across many industries.”

The EC’s announcement came after all designated gatekeepers were required to submit DMA compliance reports and scheduled public workshops to discuss DMA compliance. Those workshops conclude tomorrow with Microsoft and appear to be partly driving the EC’s decision to probe Apple, Google, and Meta.

“Stakeholders provided feedback on the compliance solutions offered,” Vestager said. “Their feedback tells us that certain compliance measures fail to achieve their objectives and fall short of expectations.”

Apple and Google app stores probed

Under the DMA, “gatekeepers can no longer prevent their business users from informing their users within the app about cheaper options outside the gatekeeper’s ecosystem,” Vestager said. “That is called anti-steering and is now forbidden by law.”

Stakeholders told the EC that Apple’s and Google’s fee structures appear to “go against” the DMA’s “free of charge” requirement, Vestager said, because companies “still charge various recurring fees and still limit steering.”

This feedback pushed the EC to launch its first two probes under the DMA against Apple and Google.

“We will investigate to what extent these fees and limitations defeat the purpose of the anti-steering provision and by that, limit consumer choice,” Vestager said.

These probes aren’t the end of Apple’s potential app store woes in the EU, either. Breton said that the EC has “many questions on Apple’s new business model” for the app store. These include “questions on the process that Apple used for granting and terminating membership of” its developer program, following a scandal where Epic Games’ account was briefly terminated.

“We also have questions on the fee structure and several other aspects of the business model,” Breton said, vowing to “check if they allow for real opportunities for app developers in line with the letter and the spirit of the DMA.”

Apple, Google, and Meta are failing DMA compliance, EU suspects Read More »

Reddit faces new reality after cashing in on its IPO

IPO, Policy, reddit, syndication / Rejus Almole / March 23, 2024

r/WallStreetBets —

Reddit must now answer to its shareholders as well as its vocal users.

Hannah Murphy and Anna Mutoh, Financial Times – Mar 23, 2024 10: 10 am UTC

In an interview on the New York Stock Exchange trading floor ahead of Reddit’s market debut on Thursday, chief executive Steve Huffman acknowledged that the mischievous retail investors that congregate on the social media platform might deliberately drive down its share price.

“It’s a free market!” he said.

For Reddit, as for Huffman, the bet on a public offering for a site he described as a “fun and special, but sometimes crazy place” has appeared to pay off.

Shares of the social media company soared on its Big Board debut under the ticker RDDT, closing at $50.44, or 48 percent above its IPO price. This brought its fully diluted market capitalization to $9.5 billion, close to where the company was last valued privately at $10 billion in 2021.

Reddit’s journey to public markets marks a turning point for a fringe, free speech-oriented platform dominated by esoteric memes, sardonic humor, and gamers, as it transforms itself into a more mainstream discussion hub that enforces stricter moderation rules in order to attract advertising dollars.

The picture for its earlier investors was mixed. One big winner was the Newhouse family, who through Advance Magazine Publishers Inc own Condé Nast, which bought Reddit in 2006 for $10 million before spinning it out in 2011. Its shares are now worth about $2.1 billion, a handsome windfall to their publishing empire, which also includes Vanity Fair, the New Yorker, and Vogue. Entities affiliated with OpenAI chief executive Sam Altman now hold a stake worth $613 million.

But investors who put money in at the last financing round in 2021 at $61.79 a share, such as Fidelity, were looking at slightly less on that particular investment.

Founded in 2005, the self-proclaimed “front page of the internet” has battled through management upheaval and moderation scandals to grow to 73 million daily users across its 100,000 communities, or “subreddits,” per Reddit parlance. It is a social media minnow, however, relative to Meta or X, which have more than 2.1 billion and 245 million daily active users, respectively.

Still, its IPO attracted institutional interest. Demand was strong, and the top two dozen investors in the deal, who received the majority of its shares, were typically large asset managers who intend on owning the stock for the long term, one person familiar with the matter said.

Reddit’s surge on its first day of trading, a day after AI infrastructure group Astera Labs jumped 72 percent in its Nasdaq debut, also signals a validation of public investor demand for listings—even a company that is unprofitable, such as Reddit.

“Overall, this is a very positive development for IPO markets [and] should bode well for many of the pre-IPO companies sitting in the queue,” said Christian Munafo, chief investment officer of Liberty Street Advisors.

But, Munafo said, “while [Reddit] performed well out of the gate, the stock may come under pressure unless they are able to demonstrate better growth and monetization.”

Either way, the deal is a boon for Huffman. The chief executive sold 500,000 of his shares in the IPO, cashing out a plump $17 million, and is due to receive additional equity awards as a result of listing the company above a $5 billion valuation. He also received an estimated $193 million pay package last year, mostly made up of equity awards, according to filings.

Historically, Huffman’s style as a leader has reflected that of Reddit’s unruly user base. The self-confessed “internet troll” initially squirmed at the idea of policing the more extreme communities hosted on the platform, relying on these groups to create their own rules and self-moderate. He has defended and cheered on Reddit’s WallStreetBets trading forum that shot to mainstream fame when members collectively bought so-called meme stocks in a bid to squeeze hedge funds*.

But Huffman has recently been forced to tidy up the darker underbelly of the platform for advertisers, present a more professional front to Wall Street and hunt harder for profitability. As a result, Reddit has shifted its ambitions slightly to pin its fortunes to wider tech trends. When Reddit first filed for an IPO in 2021, AI was mentioned once in its prospectus. In the 2024 version, AI appeared more than 60 times.

Nevertheless, the approach has left Huffman and the company at odds with some Reddit communities, who have been resistant to any changes to the platform. Facing new pressures as it enters public markets, some analysts warn that Reddit’s character could be destroyed and users may seek out alternatives, in a drag to the company.

“Reddit, more so than many social media platforms, has been a very community-based, non-commercial space and people know and love it for [this],” said Samuel Woolley, a propaganda expert and assistant professor at the University of Texas at Austin.

“I think the big question that should be on everyone’s mind for Reddit is to what extent the IPO will change the very nature and fabric of the platform.”

Additional reporting by Nicholas Megaw in New York.

Reddit faces new reality after cashing in on its IPO Read More »