4 Dems Pushing Game Companies To Drop Loot Boxes Pointing At UK Law That Doesn't Mention Loot Boxes

from the what's-in-the-box dept

Somehow, despite all odds, the conversations between the public and the video game industry about loot boxes are still going on. If you're not familiar with loot boxes, they are a randomized reward, typically after a purchase, that provides some kind of in-game benefit, cosmetic or in gameplay, to the purchaser. Because of their random nature, a whole lot of people consider them both a form of gambling (kinda) and an affront to fair online competitive gameplay (definitely) because they allow those with money to be stronger in the game than those without money. This consternation has caught the eyes of politicians, who then attempt to trade off of it in order to build up some kind of goodwill with the gaming public. You will recall that Josh Hawley introduced a doomed bill in the Senate to "regulate play to win" practices of video game companies. The bill died in Congress without receiving a vote.

Well, now a group of Democrats are trying to get larger gaming companies to self-regulate their own loot box practices by pointing to a UK law of all things.

Democrats are calling on some of the largest gaming companies to better protect children by extending new UK design rules to children in the US. The regulations could ban companies from selling in-game loot boxes to minors, among other restrictions. In letters to a dozen major gaming companies, including Blizzard, Epic Games, Microsoft, Nintendo, and Riot, Sen. Ed Markey (D-MA), Rep. Kathy Castor (D-FL), and Rep. Lori Trahan (D-MA) pressed executives to extend new UK design regulations to children in the US.

“It is imperative that Congress acts with urgency to enact a strong privacy law for children and teens in the 21st century,” the lawmakers wrote. “As we work towards that goal, we urge you to extend to American children and teens any privacy enhancements that you implement to comply with the AADC.”

You can read the entire letter here (PDF). One important section of that letter to gaming executives includes this.

Loot boxes go one step further, encouraging purchase before a child knows what the “bundle” contains— akin to gambling.3 Children are uniquely vulnerable to manipulation and peer pressure associated with in-game purchases and loot boxes. Experts suggest that Entertainment Software Rating Board (ESRB) ratings and parental controls are insufficient. 4 The AADC represents a monumental step towards child centric design by default.

And, with respect to loot boxes, that is a very interesting position to take for this group of politicians. Why? Well, primarily because the AADC has literally nothing to say about loot boxes. As in, it doesn't even mention them. The AADC is also not a "law", but a regulatory set of standards.

However, the code explicitly mentions neither loot boxes nor in-game gambling, nor ever really even alludes to them. While the subjects of loot boxes and IAPs came up during the UK regulator’s research into “Detrimental use of data,” it’s not a factor of the final publication. It’s certainly a stretch to see how the content of the AADC relates to what’s raised in the letter sent to US publishers.

And so, to summarize: a group of Democrats are attempting to gaslight the gaming industry into doing what they want by citing a regulation from another country that doesn't even apply to its demands, all under threat of actual American legislation. "Do what we say even though our argument doesn't make sense or we'll force you to do it anyway" is not a great look for any politician, never-mind one attempting to apply this towards an industry that is absolutely protected by the First Amendment. The goal of introducing protections for children against micro-transaction practices in video games may well be a well-intentioned goal, but getting there by sneaky means doesn't fill the soul with confidence.

But, then, so little about Congress does these days.

Filed Under: congress, ed markey, kathy castor, loot boxes, lori trahan, regulations, uk, video games

Oatly Loses Trademark Suit Against Glebe Farm Foods' PureOaty Product

from the oat-brand dept

A couple of months back, we discussed something of a silly lawsuit overseas between Oatly, a large oat-milk manufacturer, and Glebe Farm Foods over its own PureOaty drink. At issue were Oatly's own trademarks and its claims that PureOaty infringed on those marks. As we noted at the time, because the word "oat" is descriptive of the products in both cases, and with PureOaty using the "pure" as a differentiator among other things, this was a trademark claim that essentially came down to the letter "y". And, yes, that is dumb. Especially when you consider that there are significant differences when it comes to PureOaty's trade dress.

There is simply little reason to be concerned about public confusion between those two products when you take everything in sum total. The colors in the branding are different, and the trade dress and placement generally doesn't lend itself towards public confusion.

And it turns out that the courts in the UK agree.

Judge Nicholas Caddick at London’s High Court dismissed claims by the Malmo-based group that Cambridgeshire-based Glebe Farm Foods, which specialises in gluten-free oats, of infringing trademarks including the Oatly brand name and pack design, and of “passing off” the beverage as Oatly.

In his ruling, the judge said the visual similarity of the names were “very modest” and that there was no evidence of actual confusion among consumers regarding the two products.

Both parties were reached for comment after the ruling. Glebe Farm Foods was understandably pleased with the result, noting that it isn't always the case that smaller entities like its company can beat large enterprises like Oatly in court, even on the merits. Oatly, for its part, claims it will not appeal the ruling and accepts it, adding that it never actually wanted to harm Glebe Farm Foods in the first place.

Oatly added that it never brought the case to damage Glebe Farm and wanted them “to thrive and help bring products into the world that are good for the planet”. “We wish Glebe Farm total success in their plant-based journey moving forward,” it said.

Kind words, but somewhat tone-deaf given that even Oatly acknowledged that this entire lawsuit was initiated essentially over the letter "y". That this single character resulted in a lawsuit of all things doesn't lend a lot of credence to Oatly's "I'm okay, you're okay" posture.

Filed Under: confusion, oat milk, pureoaty, trademark, uk
Companies: glebe farm foods, oatly, pureoaty

Europe's Human Rights Court Says UK Mass Surveillance Violated Rights, Unlawfully Obtained Journalists' Communications

from the leaking-works dept

Another court case prompted by the Snowden leaks has reached its conclusion. And the findings are that Snowden's revelations were accurate: the NSA's Five Eyes partners were breaking laws and ignoring people's rights when engaging in mass surveillance. That's just a natural side effect of grabbing communications and data in bulk and pretending it's lawful if you sort through it after you've already acquired it.

The UK spy agency GCHQ’s methods for bulk interception of online communications violated the right to privacy and the regime for collection of data was unlawful, the grand chamber of the European court of human rights has ruled.

In what was described as a “landmark victory” by Liberty, one of the applicants, the judges also found the bulk interception regime breached the right to freedom of expression and contained insufficient protections for confidential journalistic material but said the decision to operate a bulk interception regime did not of itself violate the European convention on human rights.

Another one of the claimants -- the Bureau for Investigative Journalism -- says this is a win for journalists all over Europe. The ruling institutes more protections for news gatherers, which should hopefully prevent some of these violations from reoccurring.

The UK government violated the freedom of the press for decades under its mass spying programme and must now seek independent permission to access any confidential journalistic material, the European Court of Human Rights has ruled.

In a significant victory for press freedom, the new protections will apply to all confidential material collected by journalists in their reporting, not just the identity of sources. The judgment covers state authorities across Europe, including intelligence agencies, government departments and the police.

Unfortunately, it takes lots of plaintiffs and millions of dollars just to obtain a common sense ruling that intercepting journalists' communications and metadata is a violation of rights. It also takes whistleblowers willing to come forward and expose what they've seen while working for surveillance agencies. It's very unlikely a case would have been brought -- much less won -- without the Snowden leaks. This legal process began in 2013, shortly after Snowden started releasing material to journalists. And some of the recipients of these leaks saw themselves attacked and surveilled by their governments for reporting on these documents.

From now on, any surveillance targeting journalists or inadvertent collection of their communications and data must be run by an independent entity before it can be used in investigations or prosecutions. The spy agencies must prove their interests are greater than the public's interest in whatever the journalists are reporting on. They also must show there's no other way to obtain this same information without utilizing data and communications obtained from journalists. Yes, this may encourage parallel construction and other data laundering, but at least it should deter the direct targeting of journalists.

There may be more favorable rulings in the future. One of the complainants says this win will allow some of its other legal challenges against mass surveillance to move forward. And some of the 17(!) dissenting judges said this ruling -- while a landmark decision -- does not go far enough to protect journalists and other innocent people from bulk surveillance.

Then there's the UK's "Snooper's Charter" -- one that's been in the works for nearly a half-decade -- which would expand surveillance powers in the UK. The UK exited the European Union, making it unclear what effect this decision would have on domestic surveillance. And the UK government's ongoing war on encryption makes it clear many of those currently writing and approving legislation don't really care if rights are violated -- not if those rights stand in the way of law enforcement investigations and vague national security interests.

But it's still a significant win. While it may do little for UK journalists now or in the future, it does erect additional protections for journalists located elsewhere in Europe. And it shows whistleblowing works and, indirectly, why far too many governments have decided whistleblowers are threats to be eradicated, rather than protected.

Filed Under: ed snowden, eu, european court of human rights, gchq, human rights, snowden leaks, surveillance, uk

UK Court Overturns 39 Convictions Of Post Office Workers Caused By Buggy Software

from the shittiest-skynet-ever dept

Never underestimate the power of technology to destroy lives. Flawed software used for the last 20 years by the UK postal service resulted in dozens of wrongful criminal convictions which are only just now being overturned.

Judges have quashed the convictions of 39 former postmasters after the UK's most widespread miscarriage of justice.

They were convicted of stealing money, with some imprisoned, after the Post Office installed the Horizon computer system in branches.

[...]

The clearing of the names of 39 people follows the overturning of six other convictions in December, This means more people have been affected than in any other miscarriage of justice in the UK.

The notoriously buggy software debuted in 1999. Apparently it was unable to do math properly, resulting in reported cash shortages that actually weren't happening. Some employees attempted to make up these faux shortfalls with their own money by digging into savings or remortgaging their homes. Rather than address the problematic software, the UK Post Office went into prosecutorial overdrive, bringing cases against employees at the rate of one per week… for fourteen years straight. A total of 736 employees were prosecuted by the Post Office from 2000 to 2014.

And yet, the UK Post Office continued to rely on software that was actively destroying lives.

Marriages broke down, and courts have heard how some families believe the stress led to health conditions, addiction and premature deaths.

"The past nine years have been hellish and a total nightmare. This conviction has been a cloud over my life," said former Oxfordshire sub-postmaster Vipinchandra Patel, whose name was cleared late last year.

Seema Misra was pregnant with her second child when she was convicted of theft and sent to jail in 2010. She said that she had been "suffering" for 15 years as a result of the saga.

By the end of 2019, the Post Office had agreed to settle claims brought by 555 employees. And now the last of the wrongful convictions have been overturned. But, so far, no one at the Post Office or Fujitsu (the software developer) has been held accountable for the nearly 20-year run of destruction they oversaw.

That could change in the near future. The UK court seems completely unimpressed with the Post Office's actions (or lack thereof).

At the Royal Courts of Justice in London, Lord Justice Holroyde said the Post Office "knew there were serious issues about the reliability of Horizon" and had a "clear duty to investigate" the system's defects.

But the Post Office "consistently asserted that Horizon was robust and reliable" and "effectively steamrolled over any sub-postmaster who sought to challenge its accuracy", the judge added.

Sure, everyone at the Post Office seems pretty apologetic now. But that's after 15 years of ignoring the problem and choosing to believe software rather than the people hired to do the job. Tech can make things better and increase productivity, but it's rarely flawless and generally shouldn't be considered more trustworthy than the people who have to interact with it on a daily basis.

Filed Under: criminal convictions, software, uk, uk postal service

Boris Johnson's Phone Number Leaks: Turns Out He Uses End-To-End Encryption... While Trying To Ban It For Everyone Else

from the good-for-the-goose,-but-fuck-you dept

Well, look at that. The gossip newsletter Popbitch revealed UK Prime Minister Boris Johnson's personal phone number (in a somewhat hilarious way). The latest edition included this up at the top:

0ver the last few weeks, Boris Johnson has taken a lot of flak for refusing to change his personal mobile number. Critics say it’s highly irresponsible that any 7om, Dick or Harry could just freely add the PM on WhatsApp and strike up a chat.

8ut then the examples they give in those stories are always extremely wealthy or powerful people. Of course Sir James Dyson moves in circles where the 3M’s number is common knowledge. Obviously Mohammed bin Salman is going to have swapped digits.

It’s not as though the Prime Minister’s personal phone number could just be floating out there on the internet, is it? It would be absolutely insane if it was tacked on to the bottom of an old press release that he dished out freely while MP for Henley, and Shadow Minister for Higher Education.

A press releases which – feasibly – could still exist online. And which any old email newsletter could start p1ssing about with…

You might notice what appear to be typos there, where letters are turned into numbers. Well, there are a few more in the article as well, and... it turns out they are his phone number, which apparently has been easily available on the internet for 15 years, since it was once included in a press release that was sent out when Johnson was an opposition MP. And, as Popbitch noted, he's apparently chosen not to change it.

That, alone, is not really that interesting for a Techdirt audience -- though it does raise at least some concerns about his security practices on that particular phone. But what's much, much more interesting is that a phone number is also your identifier for end-to-end encrypted chat messaging apps including both Signal and WhatsApp. And the brilliant Alec Muffett entered the number into both apps... and found that Boris Johnson appears to be a user of both.

In case you don't know, if you put in the phone number of someone you know, it will tell you if they're on Signal or WhatsApp, and Boris quite clearly was -- though after the press got ahold of this he finally changed his number, despite keeping it for so many years. And thus, as seen in the image both above and below, we know that Boris Johnson has at least set up accounts on both of the major end-to-end encrypted messaging platforms:

Alec checked a few other services that use phone numbers as an identifier, and found no evidence of Johnson on Telegram or SnapChat. However, his use of Signal and WhatsApp is especially interesting, given that his government is working overtime to ban encryption for consumers. There was reporting just a few weeks ago that a bunch of Ministers were using both Signal and WhatsApp while still being a part of the government trying to ban encryption, but having Boris Johnson being among them really takes this all to a whole new level.

It truly shows how hypocritical they are, recognizing the value of such private messaging in their own lives, while trying to block others from using it.

Filed Under: boris johnson, encryption, for the children, going dark, hypocrite, phone number, uk
Companies: signal, whatsapp

UK Child Welfare Agency's Anti-Encryption 'Research' Ignored Everything It Didn't Want To Hear

from the when-'consulting'-just-means-'cherry-picking' dept

In late March, the UK's National Society for the Prevention of Cruelty to Children (NSPCC) started injecting its anti-encryption views into the major papers via some press releases and statements claiming encryption was the "biggest threat to children online." It also claimed its stance was supported by a soon-to-be-released report, which had gathered opinions and analysis from a number of stakeholders.

Its report debuted a few weeks later. Put together with the assistance of PA Consulting, the supposedly "balanced" report came to the conclusion the NSPCC arrived at earlier: end-to-end encryption is bad. That this wasn't greeted with gasps of shock by readers and receptive journalists shows just how much the UK government's disdain for encryption has gone mainstream. The NSPCC wasn't saying anything new about encryption. It was simply saying what the UK government has been saying for years: it doesn't care for encryption because it believes encryption aids criminals far more often than it protects innocent people, including the children the NSPCC claims to be so worried about.

The NSPCC presents its report as a research paper, but the list of stakeholders it actually chose to engage with guaranteed the report would result in the conclusions the child safety agency desired to see in print. As Barry Collins points out in his vetting of the report, the supposedly wide-ranging group of contributors was actually just a bunch of entities -- many with ties to the UK government -- which were already opposed to the deployment of end-to-end encryption by messaging platforms.

Here's what the NSPCC said it was doing to compile this report:

“The NSPCC commissioned PA Consulting to collate the viewpoints of a broad range of stakeholders, representing civil society organisations, industry, law enforcement and governments, to identify potential mitigations and trade-offs that should be considered.”

And here's what it actually did:

In total, PA Consulting interviewed 16 organisations when gathering evidence for the report, although it names only 15 of them. Only one of them could be described as a ‘civil society organisation’; six are from industry; seven are either law-enforcement, government (including the Home Office itself), or bodies that work for the protection of children; and one falls into the ‘other’ camp.

The industry members were apparently chosen for their willingness to echo the NSPCC's narrative. Vivace says it's a "consortium of the best and the brightest in the security industry." Maybe that's true, but it's also funded by the UK Home Office, so it's hardly an independent "consortium."

Here are two of the other "industry" contributors:

Thorn “builds technology to defend children from sexual abuse”, and has vociferously opposed the introduction of end-to-end encryption on its own blog.

Crisp Thinking is a social-media monitoring company, who last year announced a partnership with INHOPE, “the global network combatting Child Sexual Abuse Material”, which works directly with law-enforcement agencies.

That leaves just a handful of contributors that aren't already in favor of breaking encryption. And the single "civil society organisation" asked to contribute was Global Partners Digital. While Global Partners tends to be supportive of encryption and resistant to backdoors and other efforts to undermine user security, it's hardly the most well-known of civil organizations when it comes to encryption policy and security research, as Barry Collins points out. Others like Privacy International, Big Brother Watch, and the Open Rights Group could have been asked for input, but weren't.

Those who actually spoke out in favor of encryption were apparently sidelined by PA Consulting. One member contacted by the consulting firm summed up the experience this way:

In our work, we try to be constructive wherever possible. I was contacted by PA Consulting for an interview last September or October. And I think during that interview it was very obvious from the start that this wasn’t going to be a neutral technical analysis of encryption and the impacts that it has on different policy objectives, like tackling child abuse online.

It was obviously very much driven out of the desire by the NSPCC, I think, speaking quite frankly, to have a strong evidence base to justify their opposition to the use of end-to-end encryption.

The same went for comments going against NSPCC's narrative when the draft was circulated to participants. Very little of what was said in opposition to the report's slant made it into the final version.

If the UK government wants support for its anti-encryption efforts, it needs to do better than basically lying to people. The NSPCC has its duty to protect children. But it can't do that job if encryption goes away. What protects adults (and, yes, criminals) also protects minors. Framing this disingenuous report as "research" is ridiculous. Undermining everyone's security "for the children" is actually dangerous.

Filed Under: encryption, fear mongering, going dark, uk
Companies: nspcc, pa consulting

UK Politicians Getting Serious About Ending End-To-End Encryption

from the bad-news dept

Last week we noted that there was some fairly mixed up pressure mounting on UK politicians to block encryption from some confused charities which (falsely) thought that ending encryption would somehow protect children. We also noted that many of the politicians pushing to end encryption... were using encrypted messaging themselves in an effort to dodge public records requests.

And now more news is coming that the UK government is getting serious about ending encryption. UK Home Secretary Priti Patel -- who has been pushing to end encryption for a while now -- seems to be using the misguided statement from the charity mentioned above, the National Society for the Prevention of Cruelty to Children (NSPCC), as an excuse to bring about the end of true end-to-end encryption in the UK:

Patel will headline an April 19 roundtable organised by the National Society for the Prevention of Cruelty to Children (NSPCC), according to a draft invitation seen by WIRED. The event is set to be deeply critical of the encryption standard, which makes it harder for investigators and technology companies to monitor communications between people and detect child grooming or illicit content, including terror or child abuse imagery.

And then it will just be more nonsense:

During the event, the NSPCC will unveil a report on end-to-end encryption by PA Consulting, a UK firm that has advised the UK’s Department for Digital Culture Media and Sport (DCMS) on the forthcoming Online Safety regulation. An early draft of the report, seen by WIRED, says that increased usage of end-to-end encryption would protect adults’ privacy at the expense of children’s safety, and that any strategy adopted by technology companies to mitigate the effect of end-to-end encryption will “almost certainly be less effective than the current ability to scan for harmful content.”

The report also suggests that the government devise regulation “expressly targeting encryption”, in order to prevent technology companies from “engineer[ing] away” their ability to police illegal communications. It recommends that the upcoming Online Safety Bill – which will impose a duty of care on online platforms – make it compulsory for tech companies to share data about online child abuse, as opposed to voluntary.

As has become common with these things the language here is presented in a manner that pretends it's not the end of end-to-end encryption. They say things like "companies just need to provide law enforcement a way in" or that they will have a "duty of care to share data," ignoring that the only way to do this is not to use end-to-end encryption, but to completely break it in a way that makes everyone -- including children -- much more vulnerable.

Pushing back against this nonsense, the Open Rights Group (ORG) in the UK has called this out for what it obviously is: the UK's plan to kill end-to-end encryption.

If, as the Wired piece suggests, Government is inclined to compel Facebook to break encryption, then this will send a strong message to all of us – regardless of what messaging service we choose to use – about our rights to privacy and freedom from surveillance. It will send an equally strong message to companies providing communication platforms in the UK, whether large or small, about what they can expect from the UK government in the years to come.

The circulation of child abuse images, and the uses of tools by criminals, absolutely need to be addressed. However there are many options to deal with this effectively, ranging from targeted cracking of devices through to infiltration of groups, and at scale, the use of metadata analysis to find malicious actors; this latter technique is already employed by WhatsApp and many other companies relating to abusive material. While Government does need to ensure these methods work, it is far from obvious that equipment interference, and the acquisition of bulk communications data, are the only reasonable means to deliver its aims.

We have known for many years that it was not a matter of if, but when, the UK government and Home Office would seek to restrict the use of encryption. Their intentions have been publicly stated for quite some time, alongside similar gestures by other countries in the Five Eyes surveillance alliance.

The Wired piece also highlights a fear that the UK government might try to enforce all this in secret -- using a secret order (the equivalent of an NSL here in the states) to force the companies to break encryption while gagging them from talking about it. ORG is, quite reasonably, raising the alarm on that possibility too:

A company which is subject to a TCN is legally barred not only from discussing the specifics of the notice, but from disclosing whether the notice exists at all. Any employee of a company subject to a TCN who disclosed that one existed would be subjected to criminal penalties for breaking a gagging order. The powers also appear to apply to the use of “warrant canaries”.

Because of that, we do not know how many TCNs have been applied to date under the Investigatory Powers Act, we do not know whether they have proven effective, and we do not know when they were suspended. TCNs are applied under a level of secrecy which, legally, cannot even be reported. The only thing you will ever learn about the insinuation that a TCN exists is in the annual reports of the Investigatory Powers Commissioner’s Office, who can only discuss the fact that they exercised oversight over one. No further details can be disclosed.

Quite simply, this means that if a TCN were to be applied, any private message exchanged on Facebook/WhatsApp could be subject to monitoring and surveillance, with no notice, recourse, or transparency, and the company would be legally barred from disclosing the fact that the surveillance exists.

As ORG requests, Parliament needs to demand transparency and accountability regarding what the Home Office is doing with regard to encryption, as it impacts the privacy and safety of everyone -- including those anti-encryption politicians who are still using encryption.

Filed Under: encryption, end-to-end encryption, priti patel, security, uk
Companies: nspcc

UK Legislators Are Using Encrypted Messaging Services To Possibly Dodge Records Requests

from the never-attribute-to-stupidity-what-can-be-chalked-up-to-malice dept

Sure, we all love secure communications. And government officials shouldn't be afraid of using encrypted communication options. But they need to remember their obligations to the public. Security can often be converted to obscurity. And yet, government officials migrate towards encrypted messaging options, but not for security reasons. Instead, they choose the same options they decry in public. Encryption is for criminals they claim, even as they avail themselves of the "criminal" option to "protect" themselves from the public they serve.

Lawmakers continue to demand "lawful access" to encrypted/fleeting communications. And they do this while utilizing the same services. Whatever it takes to keep the general public from viewing the sausage-making process. It's not just a US thing. Our counterparts in the UK are just as hypocritical, as the BBC reports.

Ministers could be banned from using self-destructing messages on Whatsapp or Signal for official business if a legal challenge is successful.

Transparency campaigners have sent a letter to the government, arguing that politicians and staff could avoid accountability by using these features.

Members of both the Cabinet and Shadow Cabinet use Whatsapp and Signal.

Whatsapp and Signal both utilize end-to-end encryption. More relevant to this discussion is both apps allow for automatic deletion of messages. The UK government needs to say more than this when it's utilizing apps with built-in self-destruct options.

The Cabinet Office said records of official communications are "retained in line with guidance".

We're apparently just supposed to believe the government is retaining messages delivered via services that have baked in options for periodic, automatic deletion of communications.

This isn't to say government officials shouldn't avail themselves of encrypted communication options. They definitely should. Encryption is a valuable frontline defense against malicious hackers. But policies should be written to specifically address this in order to ensure the most important stakeholders in governance -- the members of the public paying their salaries -- can still access official communications.

If the government can't sort this out itself, maybe the courts will have to. There's a lawsuit threat dangling over the UK government if it can't provide an adequate response to public interest groups that suspect lawmakers' moves to encrypted services aren't so much about security as they are about opacity. Campaign law group Foxglove has already filed a lawsuit demanding to know whether the government is utilizing this for security reasons or for the other reason, which would be to separate the public from information the public should have.

As was stated earlier: encryption is great. It secures communications. What it shouldn't do is provide a handy excuse for government employees to ditch their obligations to the public. By all means, keep malicious actors out. But let the public in.

Filed Under: encryption, records requests, transparency, uk