eBay Execs Thought Sending Dead Pigs, Live Spiders To Small News Website Was A Good Idea

from the utterly-batshit dept

Pop quiz: a couple publishes a relatively small news website critical of your massive and hugely profitable corporation.

Do you:

Apparently if you're employed at eBay, the answer is an enthusiastic C. Six (now former) executives and employees of eBay are facing federal charges after they participated in massive, grotesque harassment campaign targeting the publishers of a small news outlet (Ecommercebytes.com, published by David and Ina Steiner) critical of eBay. Said harassment campaign included sending porn to the Steiners' neighbor under their name, and also sending them live spiders, bloody pig masks, cockroaches, and even a dead pig fetus. Why? They were upset by both the newsletter and anonymous commenters:

"Members of the executive leadership team at eBay followed the newsletter’s posts, often taking issue with its content and the anonymous comments underneath the editor’s stories. It is alleged that in August 2019, after the newsletter published an article about litigation involving eBay, two members of eBay’s executive leadership team sent or forwarded text messages suggesting that it was time to “take down” the newsletter’s editor.

In response, Baugh, Harville, Popp, Gilbert, Zea, Stockwell, and others allegedly executed a three-part harassment campaign. Among other things, several of the defendants ordered anonymous and disturbing deliveries to the victims’ home, including a preserved fetal pig, a bloody pig Halloween mask, a funeral wreath, a book on surviving the loss of a spouse, and pornography – the last of these addressed to the newsletter’s publisher but sent to his neighbors’ homes."

These weren't all low level employees, either. They included eBay’s senior manager of global intelligence, a manager of eBay's global intelligence center (GIC), a contractor who worked as an intelligence analyst within the GIC, and a senior manager of special operations for eBay’s global security team --and a former cop. In short, all folks who should have known better. And if you spend some time reading the articles at the newsletter in question, it appears to be just a largely polite trade mag. That it set these executives off to such a degree is just bizarre.

U.S. Attorney Andrew Lelling indicated at a press conference that this appeared to be a "one off," and not part of a broader campaign against those critical of eBay. But he also made it very clear he'd never seen anything quite this grotesque and idiotic:

According to the government complaint (pdf) and press release, the plan was apparently three-phased. First, the executives decided they'd harass the couple, then they'd step in and approach the victims pretending to fix the problem they created. All in a bizarre effort to try and glean some good press for eBay in a newsletter that (no offense to the Steiners) isn't even that big:

"As part of the second phase of the campaign, some of the defendants allegedly sent private Twitter messages and public tweets criticizing the newsletter’s content and threatening to visit the victims in Natick. The documents allege that Baugh, Gilbert, Popp and another eBay security employee planned these messages to become increasingly disturbing, culminating with “doxing” the victims (i.e., publishing their home address). It is alleged that the very same group intended then to have Gilbert, a former Santa Clara police captain, approach the victims with an offer to help stop the harassment that the defendants were secretly causing, in an effort to promote good will towards eBay, generate more favorable coverage in the newsletter, and identify the individuals behind the anonymous comments."

But wait, it gets crazier. After engaging in grotesque harassment, then pretending to help in the belief it would net eBay some good press, the folks involved in the effort decided to engage in surveillance of the couple, at times justified by falsely claiming they had threatened eBay executives. At least some of these efforts may have had the blessing of former eBay CEO Devin Wenig (who urged executives to "take her down," according to the complaint). Those involved even crafted fake documents to help them lie about the effort should they get questioned by the police:

"The third phase of the campaign allegedly involved covertly surveilling the victims in their home and community. According to the complaint, Harville and Zea registered for a software development conference to explain their trip to Boston on Aug. 15, 2019. Baugh, Harville, and Zea (and later Popp) allegedly drove to the victims’ home in Natick several times, with Harville and Baugh intending at one point to break into the victims’ garage and install a GPS tracking device on their car. As protection in the event they were stopped by local police, Baugh and Harville allegedly carried false documents purporting to show that they were investigating the victims as “Persons of Interest” who had threatened eBay executives."

Those involved then lied to law enforcement and eBay lawyers about what they'd been up to. While Lelling's office indicates this was a one off and an eBay statement downplays the scandal, it takes a very specific corporate culture to generate executives who thought this was in any way a good idea, and who were able to engage in this behavior without running into any company or institutional guard rails whatsoever (until after the fact). Meanwhile the Steiner's newsletter will ultimately wind up getting more attention than ever. Bang up job all around.

Filed Under: criticism, david steiner, doj, harassment, ina steiner, intimidation, newsletter, stalking
Companies: ebay

Appeals Court: Not A Crime To Say A Mayor Should Get His Ass Capped

from the especially-when-no-one-seems-to-know-what-exactly-that-means dept

Harassment statutes tend to be broadly written and often undergo legislative surgery after they've been challenged in court. This isn't one of those cases. The statute stands. But the conviction does not.

A New Jersey man was arrested and charged with harassment after his handwritten criticism of the Secaucus mayor was discovered and brought to the attention of the mayor, who then had to ask his daughter what the note meant.

Here's a brief summary of the alleged crime from Keldy Ortiz of NorthJersey.com.

The arrest came after [Michael] West put a sign on a locked fence on the end of Farm Road in Secaucus that read “the mayor is out of control with his draconian rules & somebody must cap his ass.” The note was found by a department of public works employee.

West had a reason for doing this:

The sign from West came after he took issue with a tree that was cut down in town.

Most people know what having your ass capped means. Most people do. Michael West claimed he didn't know what that phrase meant when he wrote it. More importantly, Mayor Michael Gonnelli didn't know what the phrase meant. Not only was the note placed somewhere the mayor was unlikely to discover it, the note was discovered by a third party who informed the mayor of its existence.

The decision [PDF] recounts what took place once the mayor took possession of the indecipherable note.

The Mayor took the note and brought it back to his home but, at that time, he did not "realize what the note meant." His wife was equally mystified. However, when he showed the note to his daughter, she "immediately told [him] what it meant."

It was only after all of this that the mayor decided he felt "uncomfortable" and decided to report it to law enforcement. The defendant spoke in his own defense at the bench trial but that didn't go all that well.

His attorney asked him: "What was the purpose? Why did you . . . put . . . that note there?" The record shows defendant's response consisted of a rambling, nonsensical diatribe in which he alleged to "being watched by two detectives" that were "standing by a rock."

He was also asked about the tree that triggered his angry note writing.

Defendant continued this stream of consciousness with irrational testimony for several transcription pages until the municipal court judge intervened…

The municipal court decided this was still harassment, mainly because of the "cap his ass" phrase. The appellate court disagrees... about a number of things.

First, the court says the municipal court judge should have recused herself since she was the one that approved the arrest warrant for the person whose case she was now trying.

But more to the harassment point, the state failed to prove this was harassment, that the defendant was trying to threaten the mayor, or even that anyone involved knew for sure the phrase "cap his ass" was clearly threatening.

The Mayor was the State's only witness. The Department of Public Works employee who discovered the note and brought it to the Mayor's attention did not testify. The note stated: "the mayor is out of control with the draconian rules & somebody must cap his ass." Both the Mayor and defendant testified that they did not know what the phrase "cap his ass" meant. The Mayor testified that his daughter told him what the phrase meant to her. The State did not produce any competent authority of the meaning of the phrase. It is undisputed that the note was posted at a place unlikely to be discovered by the Mayor. Based on the testimony of the only two witnesses, the meaning of the phrase "cap his ass" remains unsettled.

The defendant claimed he didn't know what "cap his ass" meant. He also posted the sign in a place where it was unlikely to be discovered by its supposed "target." The defendant had not engaged in any previous harassment of the mayor or any other city employees. In fact, there had been no interaction at all between the accused and the man in need of ass capping.

The state appeals court dumps the conviction.

[W]e are satisfied that based on the record before us, no reasonable fact-finder could find defendant guilty of harassment beyond a reasonable doubt.

The mayor remains as safe as he ever was. A note suggesting he would be better suited with a cap in his ass probably just summarized the opinions of his critics in somewhat cruder fashion than they would have chosen to deploy but it's still pretty far from a threat or harassment. A single note hung on the fence across an out-of-the-way road is the least effective harassment ever but it took three courts to finally come to this conclusion.

Filed Under: free speech, harassment, micael gonnelli, michael west, new jersey, secaucus

Twitter Blocks Animated PNGs After A Bunch Of Shitbirds Spend National Epilepsy Month Harassing Epileptics

from the you'll-never-go-broke-underestimating-the-quality-of-humans-on-the-internet dept

Assaulting someone with a tweet can be a criminal act. It takes a whole lot of specifics to make it a crime, but some asshole named John Rivello managed to do just that when he sent strobe gifs to Kurt Eichenwald and apparently sent him into a seizure.

Rivello did all of this under the horrible (and stupid) alias of @jew_goldstein. He also left behind a nice digital paper trial for investigators, which tied the account he used to send the strobe gifs to Eichenwald. Rivello may have used a Tracfone card to set up the accounts he used to harass Eichenwald, but these were all linked to his iPhone and his iCloud account, which helpfully included a photo of Rivello holding up his drivers license.

On top of that, investigators found a bunch of DMs to other Twitter accounts stating his intent to send Eichenwald into a seizure in hopes of killing him. So, it can be a crime to send strobe gifs to epileptics, but it takes a whole lot of work to make it a chargeable offense.

The Epilepsy Foundation is hoping law enforcement can find similar statements of intent elsewhere. During National Epilepsy Month, a bunch of people who are using far more oxygen than they deserve sent out hundreds of tweets containing strobe gifs and videos, utilizing the Foundation's Twitter handle and related hashtags. The Foundation points out that only a small percentage of epileptics are photosensitive, but any triggered seizure can carry the risk of serious injury or death.

The Foundation's post doesn't say where these complaints have been filed or provide any other details. It obviously poses some First Amendment issues in that it's asking for the prosecution of speech, but if there's enough evidence indicating some of these dirtbags were actively seeking to harm other people, First Amendment concerns will be minimal.

This brings us to another attack vector, albeit one that wasn't used in these attacks: animated PNGs. These series of images stitched together to form an animated whole would allow harassers to route around protections photosensitive epileptics used to protect themselves, like preventing autoplay of video or gif content. Twitter may not be able to do much to prevent the uploading of video and gifs containing strobe images, but it can block APNGs, which is what it is now doing.

Twitter is banning animated PNG image files (APNGs) from its platform, after an attack on the Epilepsy Foundation’s Twitter account sent out similar animated images that could potentially cause seizures in photosensitive people.

Twitter discovered a bug that allowed users to bypass its autoplay settings, and allow several animated images in a single tweet using the APNG file format.

The APNG bug has been exploited in the past, mainly to animate avatars. It apparently was not used to target epileptics during this particularly nasty exhibition of human nature, but degenerates who may have considered it a future option no longer have this exploit to work with.

No doubt someone with too much time and not enough moral fiber will find some other way to attempt to provoke seizures using nothing more than 1s and 0s, but for now, the most popular options are either closed off by built-in options or Twitter's brand new APNG blockade.

Filed Under: animated pngs, epilepsy, harassment, trolling
Companies: twitter

Online Forum Members Exploited Weak Credentials To Turn Ring Cameras Against Their Owners

from the i-m-in-ur-house-yelling-at-ur-kids dept

To add to all the bad news that is Ring camera's life cycle to this point comes the report that a group of malcontents has been exploiting default/weak credentials to gain access to cameras. Joseph Cox has the this-would-be-funny-if-it-weren't-so-scary details at Motherboard.

Hackers have created dedicated software for breaking into Ring security cameras, according to posts on hacking forums reviewed by Motherboard. The camera company is owned by Amazon, which has hundreds of partnerships with police departments around the country.

On Wednesday, local Tennessee media reported that a hacker broke into a Ring camera installed in the bedroom of three young girls in DeSoto County, Mississippi, and spoke through the device's speakers with one of the children.

The family said they had the camera for four days, during which time the hacker could have been watching the kids go about their day.

There's not much actual hacking going on. What appears to be happening is purchasers aren't choosing unique passwords when they set up their cameras. They also aren't using the two-factor authentication Ring recommends.

There are enough cameras out there (and more being installed every day) that there's an entire forum set up just for the hijacking of Ring cameras/doorbells. Forum members are selling exploit tools to each other which allow these jackasses to brute force Ring devices using credentials (usernames/email addresses and passwords) found elsewhere on the web.

The popular exploitables have even spawned a podcast featuring unsuspecting device owners being trolled by jerks who have gained access to Ring and Nest cameras. This is what's in store for device owners who haven't properly secured their new purchases.

A blaring siren suddenly rips through the Ring camera, startling the Florida family inside their own home.

"It's your boy Chance on Nulled," a voice says from the Ring camera, which a hacker has taken over. "How you doing? How you doing?"

"Welcome to the NulledCast," the voice says.

The NulledCast is a podcast livestreamed to Discord. It's a show in which hackers take over people's Ring and Nest smarthome cameras and use their speakers to talk to and harass their unsuspecting owners. In the example above, Chance blared noises and shouted racist comments at the Florida family.

Good times. Nulled forum members are starting to scatter, now that Joseph Cox has shined a light on their dirty little games. The Nulled admin has nailed an unbelievable statement to the top of the forum, saying that Nulled does not tolerate the "harassments of individuals over Ring cameras or any similar." This posting followed some "unscheduled maintenance," which occurred shortly after Motherboard's first article on Ring exploitation went live.

Panic has ensued. Cox reports the forum is in disarray, with members quitting or changing their usernames. Some appeared to be worried law enforcement is all over this. Others think the only ones going to jail are the members who participated in the podcasted Ring hijacking.

But it's not over yet. A few members appear to be willing to roll the dice on possible legal charges.

It doesn't seem the livestreaming of Ring hacking is going to end just yet, however.

"Podcast dead?" one user on the Nulled Discord asked Wednesday night.

Another user replied, "Nope. Tune in Friday. Like and subscribe."

Perhaps the focus of the podcast will change. Considering the channel's been dedicated to finding exploitable devices and exploiting them to create content, any pivot will likely be short lived.

In the meantime, Ring is doing about the only responsible thing it's ever done.

"As a precaution, we highly and openly encourage all Ring users to enable two-factor authentication on their Ring account, add Shared Users (instead of sharing login credentials), use strong passwords, and regularly change their passwords," [Ring] added.

Perhaps more education of consumers is in order. Security recommendations are great, but purchasers appear to feel installing the cameras is the end of the job. It's one thing to get your sidewalk-facing doorbell camera hacked. It's quite another to have your interior cameras turned against you. The Internet of Things continues to be awful. Ring's general awfulness kind of obscures the fact that this particular debacle isn't really Ring's fault. But it could be doing more. It could prevent deployment until two-factor authentication is engaged. And it could ease up a bit on its promises of home security when the default setup process allows outsiders to virtually enter the homes of Ring owners.

Filed Under: hackers, harassment, podcast, ring
Companies: amazon, ring

The Impossibility Of Content Moderation Plays Out, Once Again, On YouTube

from the no-one-will-agree dept

I was traveling a bit this week so didn't watch the slow motion train wreck that was happening on YouTube in real time. The latest situation began when Vox video producer Carlos Maza posted publicly on Twitter about Steven Crowder -- one of those ranty angry "comedians" -- kept posting "repeated, overt attacks on my sexual orientation and ethnicity." He noted that Crowder's fans had taken to harassing and doxxing him and generally being assholes. He "reported" the content to YouTube, saying that he felt the content violated its policies on bullying and harassment. After a few days, YouTube posted via Twitter (oddly) a kinda weird explanation, saying that after reviewing the videos, they didn't actually violate YouTube's harassment policies.

Lots of people got angry about that decision, and then YouTube changed its mind (partly), choosing to (maybe temporarily) demonetize Crowder's channel until he agreed to "address all of the issues with his channel", specifically "continued egregious actions that have harmed the broader community" whatever that means.

As Robby Soave at Reason notes, this is a solution that pissed off absolutely everyone and satisfied absolutely no one. Though, there is one thing that pretty much everyone agrees: boy YouTube sure pointed a pretty large cannon at its own foot in dealing with this one (seriously, don't they employ people who have some sort of clue about these kinds of communication issues?).

As Soave points out, there's really no good results here. He's correct that Crowder does seem to be an asshole and there's no reason to express any sympathy for Crowder being a jerk and attacking someone for their sexual orientation or ethnicity. Crowder deserves to be called out and mocked for such things. At the same time, it is quite reasonable to sympathize with Maza, as being on the end of such targeted harassment by assholes is horrific. Part of the problem, here, is the disconnect between what Crowder himself did (just be a general asshole) and what Crowder's followers and fans did (taking Crowder's assholish comments and escalating them into harassment). That puts a platform like YouTube (once again) into a really impossible position. Should it be holding Crowder responsible for the actions of his crazy deranged followers (which it can easily be argued he winkingly/noddingly encouraged) even if Crowder didn't do the harassment directly, and was just generally an asshole? It's a tough call. It may seem like an easy call, but try to apply that standard to other situations and it gets complicated fast.

Katie Herzog, at The Stranger, posted a thoughtful piece about how this particular standard could boomerang back on the more vulnerable and marginalized people in our society (as is the case with almost any effort towards censorship). Even if Crowder is deeply unfunny and a jerk, this standard creates follow on effects:

Crowder is a comic, doing exactly what comics do: Mocking a public figure. There's nothing illegal about that, and if YouTube does reverse its decision and start to ban everyone who mocks people for their sexuality or race, they're going to have to ban a whole lot of queer people of color who enjoy making fun of straight white dudes next. That's not a precedent I'd like to see set.

Of course, the usual response to this is to have people claim that we're making a bogus "slippery slope" argument that isn't there. What they mean is that since you and I can somehow magically work out which assholes deserve to be shut down and which assholes are doing it in pursuit of the larger good, then clearly a company can set in place a policy that works that says "stop just the assholes I don't like."

And there are reasons to be sympathetic to such a position. It's just that we have a couple decades of seeing how this works at scale in actual practice and it doesn't work. Ratchet up the ability to silence assholes and there are plenty of "false positives" -- people getting kicked off for dopey reasons. Go in the other direction and you end up with too many assholes on the platform. As we've discussed for years, there is no right level and there is no way to set the controls in a way that works. No matter what decision is made is going to piss off a ton of people. This is why I've been pushing for platforms to actually move in a different direction. Rather than taking on all of the policing responsibility themselves, open it up. Let others build services for content moderation, push the power to the ends of the network, and let there actually be competition among the moderation options, rather than having it come from a single, centralized source. There will still be problems with that, but it avoids many of the issues with the mess described here.

Filed Under: bullying, carlos maza, content moderation, content moderation at scale, harassment, policies, steven crowder
Companies: youtube