Massachusetts Supreme Court Tackles Law Enforcement Use Of Cell Tower Dumps

from the collect-it-all dept

Years after they've become a go-to tool for law enforcement to work their way backwards to suspects, the Massachusetts Supreme Court is wrestling with the issue of cell tower dumps.

Cell tower dumps can often be had with only a subpoena. They give investigators access to all cell phones that were in the area of the tower at certain times. Investigators peruse these lists of numbers to try to find numbers that might be linked to someone who committed a crime. The problem is investigators don't know who that "someone" is, so they, however briefly, turn everyone in the area into a suspect.

The Third Party Doctrine tends to control this collection of data. The information is collected as a necessary part of cell phone operation. Therefore, there's no expectation of privacy in this information, the theory goes, since users are aware service providers need this information to provide service. And it very well may be that cell users are aware of this. What they generally don't expect is that law enforcement can obtain this data without a warrant, or, indeed, obtain it at all when investigators don't even know who they're looking for.

The thorny issue of tower dumps is before the court, which now has the US Supreme Court's Carpenter decision to consider as well, something it didn't have prior to June 2018. In that decision, the Supreme Court says there was an expectation of privacy in cell site location data, which tower dumps are, even if they contain information on hundreds or thousands of people, rather than the more targeted collection of cell site location info related to a single targeted number.

The Carpenter decision was rather narrow, holding that use of cell site location info to track people's movements requires a warrant. But it also stated clearly that there's an expectation of privacy in these records, whether or not they're collected long term or once via a tower dump. The tracking was the issue here, but Carpenter changed how courts view cell site location info.

The state of Massachusetts has its own constitution to factor in as well. And in some cases, state constitutions have proven more protective of rights than the US Constitution, which is considered to be the floor for rights, rather than the ceiling.

Thomas F. Harrison covered the oral arguments in the Massachusetts Supreme Court for Courthouse News Service. And from what's reported here, it appears the justices aren't all that keen on pretending working backwards from untargeted data dumps isn't the sort of thing the public expects to be happening with the phone records they generate simply by taking their phones wherever they go.

"Doesn’t society have an objective expectation that you’re not going to be caught up in a police search in this way," Justice Scott Kafker asked, noting that “the idea that 50,000 people are potential suspects is a bit much."

While the justices seemed to think the police met strict constitutional standards in this case, they also worried that allowing the government to indiscriminately sweep up location data for hundreds or thousands of innocent people could lead to a dystopian result.

“It’s a slippery slope,” said Justice Dalila Wendlandt. “You could find out if a person was home at 4 a.m., or if he was in a Catholic church at 10 a.m. on Sunday.”

She added: “If you had enough data points you could put together a very good picture of Justice Wendlandt’s private life.”

“You could see if a person was at a political event or other association,” fretted Justice David Lowy.

The underlying case involved a lot of phone records. Six robberies and zero suspects led police to obtain tower dumps from near those locations, resulting in the collection of nearly 51,000 phone records. From that, police tracked down one suspect, Jerron Perry, who is charged with murder because someone was killed during one of the robberies. Perry challenged the tower dump evidence, which was rejected by the trial court, leading to this appeal to the state Supreme Court.

But this case may not go Perry's way. Unlike countless other cases, a warrant was actually obtained to collect this data. The question is what's the limit to collections obtained with warrants. Does a warrant whose only probable cause is that it's likely the service provider has these records still abide by the Constitution? Perry's representatives and entities filing amici briefs say this goes too far, making it something closer to the "general warrants" the US Constitution aimed to eliminate.

At this point, it's unclear how the justices will lean. Some, like those listed above, seemed concerned about what this does to the expectation of privacy. Others, however, did not see the warrants as "general," noting that not all warrants need to be particularized to a person. They also noted the only towers "searched" were those near the scenes of robberies, which (somewhat) particularized the searches, even if the cops had no idea who they were looking for.

And one justice said the facts of this case allowed the police to slide on one underdeveloped probable cause assumption.

Justice Serge Georges was troubled that the police simply assumed that the perpetrator had a cellphone.

“The government gets past first base without showing that a cell phone was part of the crime,” he said. “There’s just this notion that everyone has a cellphone, and it’s on. That’s just bald speculation. We have no reason to think the person who committed these crimes had a phone. We’re just going to assume. That’s the part that really bugs me.”

That is concerning. Given what's known about how often investigators start investigations with phone records -- along with how easily they can be obtained -- some criminals are probably leaving their phones behind when committing crimes. The government should have more to work with than an assumption that might be incorrect, especially when that assumption allows them to collect data in bulk.

If the court decides warrants can't be used to collect bulk data, it will be a significant privacy win for residents of the state. It will also be the first of its kind in the nation -- a prohibition on the untargeted collection of cell site location info.

Filed Under: 4th amendment, cell tower dumps, data, law enforcement, massachusetts, warrants

The Copyright Industry Wants Everything Filtered As It Is Uploaded; Here's Why That Will Be A Disaster

from the i'm-sorry,-we-can't-let-you-post-that,-dave dept

The history of copyright can be seen as one of increasing control by companies over what ordinary people can do with material created by others. For the online world, the endgame is where copyright holders get to check and approve every single file that is uploaded, with the power to block anything they regard as infringing. That digital dystopia moved much closer two years ago, with the passage of the EU Copyright Directive. At the heart of the Directive lies precisely these kind of upload filters – even though the legislation's supporters insisted that they would not be needed. When the law was safely passed – despite voting issues – only then did they admit that upload filters would indeed be required.

The parts of the EU Copyright Directive dealing with upload filters are so badly crafted that most of the EU’s Member States are struggling to implement them in their national laws in any coherent way. This means the full impact of the legislation's upload filters won't be known for some time.

Until then, we can look at the real-life effects of a similar approach, as used by YouTube. Content ID is a digital fingerprinting system developed by Google at great cost – around $100 million by 2018 – which is designed to spot and block allegedly infringing material on YouTube. Content ID’s flaws are well known, particularly in terms of overblocking perfectly legal uploads. This is the fundamental problem with all upload filters: there is no way that an automated, algorithmic system can encompass the complexities of global copyright laws, which even trained lawyers struggle with. The problem of overblocking is widely known on an anecdotal basis, but we have not had reliable data about the scale of the problem. That has finally changed with the release of YouTube’s first Copyright Transparency Report. The Kluwer Copyright Blog has a good analysis and summary of the report by Paul Keller, Director of Policy at openfuture.eu:

The overall take-away is that automated content removal is a big numbers game. In total YouTube processed 729.3 million copyright actions in the first half of 2021 of which the vast majority (99%) were processed via Content ID (as opposed to other tools, such as Copyright Match Tool and the Webform). And while YouTube claims that ContentID is much more accurate and less prone to abuse than its other systems ContentID has still received 3.7 million disputes from uploaders claiming that the actions (these can be blocks/removals but also demonetisation actions) taken against them are unjustified. 60% of these disputes have ultimately been decided in favour of the uploaders, which means that in the first half of 2021 Content ID has generated at least a 2.2 million unjustified copyright actions against its users on behalf of rightholders. In other words, over-enforcement (both unjustified blocking and unjustified demonetisation) is a very real issue that affects the rights of a substantial number of uploaders on a regular basis.

As Keller rightly notes in his post, the real number of unjustified copyright actions is likely to be larger than 2.2 million. When blocked by the Content ID system, many people will just give up, rather than instituting a formal dispute of the block. Unlike copyright companies’ well-paid lawyers, ordinary people do not have the time, money or expertise to engage in this kind of legal battle.

The figure for YouTube overblocking is bad enough. The situation once the EU Copyright Directive’s upload filters come into operation across the continent will be far worse, for a number of reasons that were widely explored by experts before the law was passed, but almost completely ignored by the EU politicians. Perhaps the most worrying aspect of the imminent upload filters is that they must apply to every kind of copyright material. YouTube only deals with music and video, and even then has enough problems with overblocking, as the new report indicates. The upload filters required by the new EU law will apply to text, images, photos, maps, music scores, ballet scores, software and 3D models amongst other things. There are currently no systems comparable to Content ID for these domains, nor are there likely to be for a long time, if ever, given the huge cost involved in developing them.

Despite this glaring omission, EU Member States are required to bring in new copyright laws, which will inevitably come with upload filter rules. This seems like a huge disaster waiting to happen – all thanks to the selfish desire of copyright companies to control down to the last byte what ordinary people do online.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Originally posted to the Walled Culture blog.

Filed Under: contentid, copyright, error rates, eu, filters

Those Who Don't Understand Section 230 Are Doomed To Repeal It

from the that's-not-how-any-of-this-works dept

It remains somewhat surprising to me how many people who have ideas for Section 230 reforms clearly do not understand the law and how it works. Perhaps much more surprising is that, when experts try to highlight where their analysis has gone wrong, these "reformers" double down rather than correct their previous faulty assumptions. Dean Baker is a fairly well-known economist whose views on copyright we've highlighted in the past for being quite insightful. Unfortunately, Baker seems to feel that his insight in these other areas allows him to skip the basics on Section 230, defamation law, internet business models and the like. A year ago he wrote two separate very wrong and very confused blog posts advocating for the full repeal of Section 230. Both of them misunderstand how 230 works, its interplay with the 1st Amendment, and how defamation law works.

I had planned to write a response to them last year, but never got around to it. However, Baker is still at it, and after Jeff Kosseff and I spent some time trying to explain some fairly basic principles that you need to understand in order to explore the trade-offs in any Section 230 reform proposal, Baker wrote a long thread ignoring the points we raised, and insisting that his plan for 230 reform wouldn't run into any issues. He's wrong, and despite my going back and forth with him over a dozen times, it's become clear that he has no interest in exploring or correcting the mistakes in his analysis. That said, I do think that he makes so many fundamental errors, that it might be useful to go through his thread to explain to other, more open-minded folks, the very significant challenges in these plans to reform Section 230.

Baker's latest proposal is apparently no longer the full "repeal" of Section 230 he wanted a year ago, but now just that only subscription supported sites (with no advertising) get the benefits of Section 230. As laid out in his thread, the underlying theory is that Facebook is too big, and by removing Section 230, this would force Facebook to downsize. This is wrong for a bunch of reasons, some of which we've explained before, but we'll get there. He seems to no longer support a full repeal of Section 230 because people highlighted how it harms other sites. So his new version is that Section 230 is only removed for sites that have advertising as their main business model under the (incorrect) theory that this will magically create a world where every site other than Facebook moves away from ads to subscription only, and that somehow makes Facebook smaller. Substacks for everyone!

So, again, the keys to Baker's plan seem to be that by removing Section 230 for ad supported sites, it somehow (1) forces Facebook to shrink and (2) forces paywalls all over the internet. And this is somehow good. Both assumptions are fundamentally wrong -- but it's important to understand why, because this mistake is made by too many people who haven't bothered to take the time to understand Section 230.

Section 230 does not provide an outsized benefit to Facebook -- instead, it protects everyone else significantly more than it protects Facebook.

This is one thing that many, many people fundamentally misunderstand about Section 230. They think that because Section 230 "protects" Facebook and Facebook is so big, that Section 230 protects Facebook more than it protects others, and therefore any removal of 230 protections will have a greater impact on Facebook than other sites.

The problem with this is that the real benefit from Section 230 is not the underlying protection from liability, rather it's the procedural benefits that 230 provides that help companies get out of frivolous lawsuits at an earlier stage. We've discussed this before a few times, but many people seem to miss it. There are two important issues as it relates to liability for websites in cases that try to drag them in: (1) what is the likelihood of any underlying cause of action actually leading to liability (outside of Section 230) and (2) how expensive is it to find out whether or not that liability sticks.

In the vast majority of cases, there is no underlying cause of action that will create liability. We've actually seen this in action in the few cases that get past the Section 230 hurdle. One of the most famous cases that chipped away at Section 230 protections was Fair Housing v. Roommates, in which the court determined that, while Section 230 protected Roommates.com from content that other users created, it did not protect the company from liability for the pull down menus that it created itself.

Many people think this means that Roommates.com lost the case, and very, very few people realize that years later Roommates.com still won, when the courts determined that even though 230 didn't kick the case out early, Roommates.com still didn't actually violate the law. The same is true of the other big 230 exception case, the more recent Enigma Software v. Malwarebytes case, in which the court (somewhat bizarrely) argued that Malwarebytes doesn't get Section 230 protections in cases where a malware designation might be deemed anti-competitive. But, in the end, many years later, Malwarebytes still won.

Again, the key benefit to Section 230 is not that it removes all liability, but rather that it gets cases dismissed very early on, cases that would have almost no chance if they went through the full litigation process. In other words, it's a form of protection against frivolous lawsuits, and the main mechanism involved is getting cases dismissed earlier, rather than years (and millions of dollars later). That helps smaller companies way more than it helps Facebook. Facebook has all the money in the world and it can afford to litigate these cases all the way through. It would cost the company pocket change, but the company would likely still win in the end.

Smaller companies, on the other hand, cannot afford the costs. Getting a case dismissed on 230 grounds might cost six figures. Having to go all the way through the full litigation is more like 7 or 8 figures (depending on circumstances). Facebook can find that money in the seat cushions of their office couches. Smaller companies cannot.

Dean also appears to not understand how defamation law works at all. In his thread, he seems to think that without Section 230, if someone posted something defamatory that would automatically make Facebook liable for the defamation:

Except, that's wrong. First off, the actual bar for defamation is quite high, especially for public figures. Baker, incorrectly, seems to think that merely saying something false about a public figure is defamatory. That's not how it works. It has to meet the standard of defamation, including the actual malice standard (which is not just that you were really mad when you said it). Second, and much more important for this situation, is that if the speaker was liable, that does not automatically mean that the intermediary would be liable. Under the two key cases prior to Section 230 becoming law, Cubby v. Compuserve and Stratton Oakmont v. Prodigy, the courts had to wrestle with what makes 3rd party intermediary liability consistent with the 1st Amendment.

And the ruling in both cases would go directly against Baker's ideas here. In Cubby, the court determined that the website needed to know about the content before it became liable for it. So, in Baker's hypothetical above, Facebook wouldn't face automatic liability unless it was first provided notice that the content was potentially defamatory. And, in Stratton Oakmont, the court said that any moderation meant you were admitting to knowledge of what you left up -- thereby encouraging no moderation at all (if you don't look, you wouldn't be liable). So Baker's insistence that he'd want more moderation to happen under his plan isn't necessarily supported by the historical precedents under the 1st Amendment.

If the courts (as would be most likely) followed a Cubby-like precedent, then all it would do is create a very expensive process for any website to handle moderation, because each "notice" would likely require adjudication. As we've seen in the copyright space, this greatly favors big companies who can hire teams to review takedown notices, meaning... it favors Facebook and would destroy smaller competitors. On the other hand, if courts actually moved to a Stratton Oakmont style standard, then it would create massive incentives for every website to do no moderation at all, filling websites with garbage (which goes against Baker's desired situation in which Facebook took down more content). But in such a world, there would be so much garbage on any site that inevitably users would rely much more on recommendation algorithms to find the content they actually want to see -- and that again favors the largest companies who can invest in such tools. Like Facebook.

I asked Baker privately why he ignored these historical precedents, and he insisted that since he's talking about a new law, it doesn't matter. But any law has to comply with the basic principles of the 1st Amendment, and if you're going further than this in automatically placing liability (rather than simply removing the procedural benefits of 230) as Baker seems to want, well, that's not going to survive any level of 1st Amendment scrutiny. The NY Times v. Sullivan sets the bar for defamation very, very high. You can't just wipe that out and claim that your new lower standard ("someone said something false!") automagically applies to third party distributors.

And, in fact, we know how this plays out in practice because we've seen it in the copyright context. Given Baker's earlier research and writings into copyright, you'd hope he'd understand this, but he seems to have not bothered. In the early days of user-generated video content online, there were a large number of companies that rushed into the space. YouTube took an early lead, but there were many others, including Veoh. Both YouTube and Veoh were sued for copyright infringement. In copyright, there's no Section 230. Rather there's the DMCA 512 safe harbors, but (unlike Section 230) you have to fight out in court as to whether or not you comply with the factors to get the 512 safe harbors.

In YouTube's case, with the help of Google money, it had to fight Viacom in court for seven whole years, and it would have gone on longer, but after Viacom kept losing every single legal argument it made, the company finally agreed to settle without any money changing hands. Veoh, on the other hand, a site founded by Hollywood insiders like former Disney boss Michael Eisner, fought for many years in its similar lawsuit which it eventually won, but only three years after the company had shut down, citing the expensive litigation as driving the company out of business.

So, to recap: Section 230 gets you out of frivolous litigation much sooner, saving smaller companies millions of dollars. Without 230, the internet websites would likely still win most such cases (as they have basically every time a plaintiff gets around 230), but it would be a lot more expensive. That's a nuisance to Facebook, but it's deadly to many, many other websites.

So, Baker's initial assumption that more lawsuits from the removal of Section 230 would somehow force Facebook to shrink and aid smaller competitors is simply wrong. Beyond explaining all the reasons why above, we have practical examples from the copyright realm with YouTube and Veoh. And if that doesn't convince you, we even have examples from Section 230 itself. In 2018, as you'll recall, FOSTA became law -- the first major attempt to chip away at Section 230. We've spent tons of time explaining the societal damage that FOSTA has created, but it also didn't "shrink" Facebook. Instead, it did the opposite.

Right after FOSTA passed, a bunch of dating websites closed down, including Craigslist shutting down its dating vertical -- explicitly stating that the threat of liability from FOSTA made it too expensive to run. A year later, Facebook jumped in to launch its own dating app. So, smaller competitors get out of the market, and Facebook gets to jump in.

The same would happen under Baker's "reform" plan here. Smaller ad supported providers would shut down, because the cost of litigation risk would be too high. Facebook would corner the market from the few competitors out there.

Subscriptions don't magically solve any of this, they mostly make it worse

But Baker insists none of this is an issue, because his plan would encourage an internet of paywalls and subscriptions, and by incentivizing that business model, mighty Facebook would be brought to its knees. Except there's no evidence to support that either. His entire basis for arguing that this would happen is that historically people subscribed to newspapers.

But that fundamentally misunderstands the nature of the internet, social media, what makes them work, and what makes this all so important for speech.

He later suggests that if sites couldn't get enough subscription support, then that fundamentally shows they're not valuable and it's okay for them to go away.

But all of that is mixing up some very, very basic concepts. First of all, social media only works well thanks to network effects. Metcalfe's Law matters. If I subscribed to the NY Times, it makes no difference to me if you subscribe to the NY Post. There is no fundamental value difference in that case.

But for the vast majority of incredibly valuable online services -- especially those involving user-generated content that need Section 230 -- a huge part of the value is proportional to how many other people are also using that service. And that doesn't work in a subscription world. Right now, I already use a half a dozen different messaging services because different friends and family tend to rely on different ones. If I had to pay $5 to $10 a month for each one, that would not work at all. Instead, the most likely scenario is that everyone would standardize on the one that everyone uses the most. And, horrifically for me (as someone who minimizes my use of Facebook), that would mean Facebook.

Also, I really wish that Dean spoke to someone who actually had some experience in the ad business and in the subscription business. Going back a decade or so it was common for people with experience in neither to insist that the two were somehow interchangeable, and you could easily convert ad-based businesses to subscription models. Except that's not true at all, in part because of the network effects point above. For the vast, vast majority of users of any particular online service, the value they get out of the site is way below $5/month. Relatedly, the value they provide to those sites by themselves is way less than $5/month in terms of ad revenue. But the collective aspect of their usage of the site, combined with the aggregate advertising model, is what makes it work.

If you had to go subscription, you'd wipe out tons of useful services that today rely on Section 230: I can't see how Reddit, Craigslist, Nextdoor, Glassdoor, Pinterest, Yelp, Travelocity, Eventbrite, Stack Overflow, Ravelry, DuoLingo, Fandom, WikiHow, Glitch and tons of other websites would survive. Baker seems to think that you'd just need one "social media" website, and so people would subscribe to the one they like best. But so much of the internet relies on Section 230 and ads to survive, and changing them all into subscription services would be untenable for the vast majority.

End result? Again, you wipe out most of the more innovative competition, and especially clear the field for new entrants. Under this model, new entrants would need to start with a subscription model, and it's difficult to get people to subscribe to a service that has no track record... and has no users.

And, of course, Baker brushes off the idea that another impact of this is that it would only serve to help the wealthy at the expense of the poor, but it's absolutely true. There's so much value on the internet that is readily available to everyone, and Baker's plan would lock that all up... because he's mad at the amount of control Mark Zuckerberg has. But locking up all those useful services, and leaving it so that Facebook can clean up and provide all those services for free (while paying the pesky litigation costs to show that it's not liable) seems like a great long term deal for Facebook.

Just as it helped get competing dating services, like Craigslist's, shut down before opening its own service, this is why Facebook is running ads and telling Congress that it's time to "update Section 230." Facebook knows that the long-term impact of such things may raise some direct costs (litigation) in the short run, but over the long run, it wipes out the thing that Mark Zuckerberg has always feared the most: disruptive innovation that competes with Facebook and takes away their userbase.

Baker's reform plan misunderstands how and why Section 230 works and where it provides the most benefit. And he misunderstands how and why network effects work online, and what his plan would do to much of the open internet. His plan would, clearly, provide Facebook significantly more power, while wiping out a stunning amount of competition. It's a dangerous plan.

Filed Under: competition, copyright, dean baker, intermediary liability, section 230

Indian Gov't Orders YouTube To Block 20 Channels For 'Blasphemy' And 'Impinging On National Security'

from the wherein-Piss-Christ-is-the-same-thing-as-a-pipe-bomb dept

India's Information Technology Act has been problematic since its inception. Almost a decade ago, it was deployed to justify the arrest of an Indian citizen who'd done nothing more than criticize a politician, insinuating the politician had used his position to amass personal wealth.

Once the politician complained, the government ignored available libel law, which would have resulted in a civil case and opted to use a clause of the IT Act which allowed prosecution for "sending an email or other electronic message that causes annoyance or inconvenience." That's how the law was used in 2012.

The 2021 version of the law is much more dangerous. Folding into the act passed in 2000 are new rules about national security. This escalates the Act's abusability, since nearly anything can be called a threat to national security and drastically limits the defenses those targeted by this part of the act can raise.

Added into this revision are new mandates for social media companies, which allows the government to hold companies responsible for content created by their users. There's a long list of forbidden content that starts with child sexual abuse material and terroristic content and ends with things like "promoting tobacco use," "blasphemy," and "harms minors in any way."

It is those changes that have resulted in the banning of 20 supposedly "anti-India" YouTube channels.

India banned 20 YouTube channels and two websites on Monday for allegedly running anti-India propaganda from Pakistan, invoking for the first time the emergency powers under the newly notified intermediary guidelines and digital media ethics code in the IT Act.

I&B secretary Apurva Chandra wrote to YouTube and the Department of Telecom, directing them to immediately block the content as it affects the sovereignty and integrity of India, people aware of the development told ET on condition of anonymity.

According to officials, these channels were being run by a Pakistan government agency. The officials also made reference to fake news and reporting on farmers' protests. The first is another term as abusable as "national security." The latter is something the Indian government has expended a lot of effort to control the narrative, often through censorship.

This is censorship as well. Even if we accept the Indian government's assertions about the origin and intent of the banned channels, the government can't even decide why it's doing this. It claims two violations -- neither of which should have anything to do with each other.

The inquiry revealed that these websites were being run from Pakistan. The content run on these channels is blasphemous and hugely impinges on national security," said the official, who was part of the review.

If your national security and national religion are intertwined, a law addressing both is a censorial cudgel. And it won't make anyone safer or make your religion any more unassailable. What it will do is allow the government to disappear information and content it doesn't like with impunity.

This has been the point of the law all along. Every iteration gives the government more power and takes it away from the country's citizens and the services they use. It elevates the government, placing it on the same level as its preferred deities. When a government does that, it no longer serves the public. The public is now expected to serve (and revere) the government.

The Indian government has all the tools it needs to ensure its narrative is the most prominent. Even before these amendments affecting intermediary liability went into effect, the government had pulled the plug on the internet in areas where farmers' protests were taking place and threatened Twitter employees with arrest for restoring accounts and content the government had ordered removed. More assertions about god(s) and country are undoubtedly on their way, forcing those carrying third party content to give the Indian government control of the narrative or face fines, fees, and possible imprisonment.

Filed Under: blasphemy, censorship, content moderation, free speech, india, information technology act, national security, pakistan
Companies: youtube

Daily Deal: OMNIA Q5 5-in-1 Wireless Charging Station

from the good-deals-on-cool-stuff dept

The OMNIA Q5 power station is specifically designed to support iPads, Apple Watch, iPhones, AirPods, and Apple Pencil simultaneously while providing optimum charging ability, and storage convenience with the necessary safety features in place. The charging station & the charging pad can be used separately. It's on sale for $99.95 and if you use the code CYBER20, you'll get an additional 20% off.

Note: The Techdirt Deals Store is powered and curated by StackCommerce. A portion of all sales from Techdirt Deals helps support Techdirt. The products featured do not reflect endorsements by our editorial team.

Filed Under: daily deal

House Republicans Don't Want Infrastructure Money Going Toward Broadband Competition

from the do-not-pass-go,-do-not-collect-$200 dept

For years the broadband industry has successfully convinced the U.S. government to remain fixated exclusively on broadband coverage gaps, not the overall lack of broadband competition. That's in part because they've known for decades that substandard maps mean policymakers have never really known which areas lack or need access. That's helped create an ecosystem where we throw billions upon billions of dollars in tax breaks and subsidies at regional monopolies every year, in exchange for broadband networks that are routinely half-completed.

With a record $42 billion broadband investment on the horizon, the industry is obviously worried that some of that money might go toward (gasp) added competition. As in, not just used to expand access to the estimated 20-40 million Americans without broadband, but funding to help bring new competitors to the estimated 83 million Americans living under a broadband monopoly. That regional monopolization, as we've long documented, is why U.S. broadband tends to be expensive, spotty, slow, and with terrible customer service.

Of course you can't just come out and acknowledge you don't want money going toward encouraging broadband competition, even though more competition would greatly benefit consumers, small businesses, and countless internet-based economies. So instead the industry's biggest players (and the politicians and regulators paid to love them) like to complain about "overbuilding," or the act of creating "duplicative" broadband networks in "already served" areas. This is generally framed in such as a way as to make it sound as if broadband in most parts of the country is already wonderful, and spending any money to expand access in these "already served" areas would be completely wasteful.

That rhetoric and language was quick to pop up in a House Republican letter sent to the two agencies overseeing fund distribution: the NTIA (pdf) and FCC (pdf). In the letters, lawmakers profess they're just super duper worried about the potential for waste:

"Given the billions of dollars concurrently being awarded for broadband infrastructure deployment by several agencies and the Commission, this Office is on the front line of preventing duplicative and wasteful subsidized overbuilding.As you work to allocate grants pursuant to these laws, we urge you to prioritize funding for unserved communities that lack access to any broadband connection rather than funding duplicative or upgraded service in areas that already have broadband access.

Here's the thing though: House Republicans are defining "access" as just a single ISP offering speeds of 25 Mbps downstream, 3 Mbps upstream. More often they define it as "any broadband at all, however pathetic." As such, "access" as theses folks envision it could be a single terrible cable company, a single lazy phone company offering substandard DSL, or a single satellite broadband provider offering capped, expensive, slow, high-latency satellite. That's, well, a monopoly. Lawmakers are being prodded by giants like AT&T to ensure that nobody does much of anything to challenge said monopoly, but it's framed in such a way as to make it sound as if lawmakers are doing due diligence regarding fraud and waste.

In reality you can focus on shoring up broadband coverage gaps and expanding competition. In fact, these often operate synergistically. We've seen time and time again how local competition forces entrenched broadband providers to expand their footprint, lower prices, or offer significantly faster speeds. So by funding and encouraging competition, you technically are also helping to shore up broadband coverage gaps.

While the government is no stranger to waste, most of the waste in telecom has generally come at the hands of the telecom monopolies whose turf House Republicans are protecting here. Countless billions have been thrown at giants like AT&T, Frontier, and Verizon for networks they routinely only half deploy. In the twenty years I've covered the sector I've lost track of the billions of state and federal dollars given to giant industry incumbents for network upgrades that simply don't arrive (often with zero meaningful penalty). Notice how it's rarely a concern if the company getting the money is, say, AT&T.

Yeah, the broadband component part of the infrastructure bill is going to be a massive challenge, in large part because most of the broadband mapping improvements being adopted won't arrive in time. Entrenched monopolies of course know this, and are busy injecting themselves in the process on both the state and federal level to ensure as much money as possible goes to them, and not potential competitors. Loyal lawmakers want to help them in this process under the performative cover of just being ultra concerned about government efficiency and waste, when in reality it's all about defending the busted (but very profitable) status quo.

Filed Under: broadband, competition, fcc, infrastructure, ntia, spending

Former US Intelligence Analysts Sued For Hacking A Saudi Activist's Phone On Behalf Of The United Arab Emirates

from the hacking-victim-getting-the-chance-to-inflict-some-misery-of-her-own dept

In early 2019, a whistleblower revealed some ugliness emanating from the United Arab Emirates: former NSA analysts working for a private company hired to perform counterterrorism work for the government were spying on journalists, activists, and the occasional American citizen on behalf of their royal benefactors.

Why these analysts were working for known human rights abusers was unclear. Why they decided this work should involve targeting people who weren't terrorists, but rather critics of the UAE government, was similarly left unexplained. The program was called Project Raven and former employee Lori Stroud was the only person involved willing to speak publicly about its activities. Everyone else -- from the NSA to the UAE government -- refused to comment.

More than two years later, the harms perpetrated by these former analysts were given a price tag. Three former US intelligence community analysts (two of which worked for the NSA) were fined $1.68 million for utilizing powerful hacking tools to target dissidents, activists, journalists, and the occasional American citizen for the UAE government. The tools used included "Karma," which was capable of remotely compromising targets' phones without any interaction from phone owners, allowing for wholesale collection of photos, emails, text messages and location information.

Over the years covered in the indictment (which resulted in the fines mentioned above), the analysts began with Project Raven, which migrated from Cyberpoint (a company associated with Italy's infamous Hacking Team), before finally ending up as a wholly-UAE-owned company called Darkmatter.

It's this company that's now being sued by one of its targets, a Saudi activist represented by the EFF.

The Electronic Frontier Foundation (EFF) filed a lawsuit today on behalf of prominent Saudi human rights activist Loujain AlHathloul against spying software maker DarkMatter Group and three of its former executives for illegally hacking her iPhone to secretly track her communications and whereabouts.

AlHathloul is among the victims of an illegal spying program created and run by former U.S. intelligence operatives, including the three defendants named in the lawsuit, who worked for a U.S. company hired by United Arab Emirates (UAE) in the wake of the Arab Spring protests to identify and monitor activists, journalists, rival foreign leaders, and perceived political enemies.

The defendants include Darkmatter, the UAE-owned company that acted on behalf of the Kingdom of Saudi Arabia. Also named are the three former US Intelligence Community analysts who were fined $1.68 million by the federal government in September 2021.

A lot of what's alleged mirrors what we've been seeing over the past several months emanating from Israel malware manufacturer, NSO Group: powerful phone hacking tools, authoritarian governments, and the targeting of government critics, political opponents, and journalists. We've heard plenty about who's been targeted. We don't often hear what happens to those targeted when the governments targeting them finally catch up to them. AlHathoul's lawsuit [PDF] details the end result of her targeting by former NSA analysts working for Project Raven and Darkmatter.

[AlHathloul's] phone was initially hacked in 2017, gaining access to her texts, email messages, and real-time location data. Later, AlHathloul was driving on the highway in Abu Dhabi when she was arrested by UAE security services, and forcibly taken by plane to the KSA, where she was imprisoned twice, including at a secret prison where she was subject to electric shocks, flogging, and threats of rape and death.

I'm sure the named analysts would prefer not to know the human misery their work for the UAE and KSA (Kingdom of Saudi Arabia) resulted in. It's always easier to think of targets in the abstract: an identifier devoid of personal agency, compromised and controlled by ones and zeroes similarly devoid of personality. This lawsuit will force them to confront what they enabled and, possibly, compensate this activist for the harms they enabled.

Filed Under: activism, hacking, karma, malware, nsa, spyware
Companies: darkmatter

A Grope In Meta's Space

from the the-value-of-user-tools-in-moderation dept

Horizon Worlds is a VR (virtual reality) social space and world building game created by Facebook. In early December, a beta tester wrote about being virtually groped by another Horizon Worlds user. A few weeks later, The Verge and other outlets published stories about the incident. However, their coverage omits key details from the victim’s account. As a result, it presents the assault as a failure of user operated moderation tools rather than the limits of top-down moderation. Nevertheless, this VR groping illustrates the difficulty of moderating VR, and the enduring value of tools that let users solve problems for themselves.

The user explains that they reported and blocked the groper, and a Facebook “guide”, an experienced user trained and certified by Facebook, failed to intervene. They write, “I think what made it worse, was even after I reported, and eventually blocked the assaulter, the guide in the plaza did and said nothing.” In the interest of transparency, I have republished the beta user’s post in full, sans identifying information, here;

**Trigger Warning** Sexual Harassment. My apologies for the long post: Feel free to move on.

Good morning,

I rarely wake up with a heavy heart and a feeling of anger to start a fresh new day, but that is how I feel this morning. I want to be seen and heard. I reach out to my fellow community members in hopes of understanding and reassurance that they will be proactive in supporting victims and eliminating certain types of behavior in horizon worlds. My expectations as a creator in horizon worlds aren't unreasonable and I'm sure many will agree.

You see this isn't the first time, I'm sure it won't be the last time that someone has sexually harassed me in virtual reality. Sexual harassment is no joke on the regular Internet but being in VR adds another layer that makes the event more intense. Not only was I groped last night, but there were other people there who supported this behavior which made me feel isolated in the Plaza. I think what made it worse, was even after I reported, and eventually blocked the assaulter, the guide in the plaza did and said nothing. He moved himself far across the map as if to say, you're on your now.

Even though my physical body was far removed from the event, my brain is tricked into thinking it's real, because.....you know......Virtual REALITY. We can't tout VR's realness and then lay claim that it is not a real assault. Mind you, this all happened within one minute of arriving in the plaza, I hadn't spoken a word yet and could have possibly been a 12-year-old girl.

MY ASK:

I would like a personal bubble that will force people away from my avatar and I would like to be able to upload my own recording with my harassment ticket. I would also like that all guides are given sensitivity training on this specific subject, so they will understand what is expected. If META won't give guides tools that will allow them to remove a player immediately from a situation, at least train them to deal with it and not run away.

Rant over, I'm still mad, but I will sort through and process. I love this community and the thought of leaving it makes me deeply sad. So I am hopeful we can evolve as a community and foster behaviors that support collaboration, understand, and a willingness to speak out against gross behaviors.

Initial coverage in The Verge did not mention the victim’s use of the block feature, even as the user describes using it in the post above. Instead, reporter Alex Heath relayed Facebook’s account of the incident, saying “the company determined that the beta tester didn’t utilize the safety features built into Horizon Worlds, including the ability to block someone from interacting with you.”

These details are important because subsequent writing about the incident builds on the false, but purported non-use of the blocking feature to make the case that offering users tools to control their virtual experience is “unfair and doesn’t work.” In Technology Review, Tanya Basu makes hay of the user’s failure to use the “safe zone” feature, which temporarily removes users from their surroundings. Yet this is a red herring. The user might not have immediately disappeared into her safe zone, but she used the block feature to do away with her assailant.

In reality, contra Basu or Facebook’s description of events, it seems that user-directed blocking put a stop to the harm while the platform provided community guide failed to intervene. VR groping is a serious issue, but it is not one that will be solved from the top-down. Inaccurate reporting that casts user-operated moderation tools as ineffective may spur platforms to pursue less effective solutions to sexual harassment in VR.

Implications of the incident’s misreporting aside, it provides a useful case study in the difficulties of moderating VR. One suggestion put forward by the user and backed by University of Washington Professor Katherine Cross warrants discussion. Closer inspection of their proposals illustrates the careful tradeoffs that inform the current safe zone and blocking tools offered to Horizon users.

They request a “personal bubble that will force people away from my avatar” or “automatic personal distance unless two people mutually agreed to be closer.” This might make some groping harder, but it creates other opportunities for abuse.

If players’ avatars can take up physical space and block movement, keeping others at bay, then they can block doorways and trap other players in corners or against other parts of world. Player collision could render abuse inescapable or allow players to hold others’ avatars prisoner.

MMOs (Massively Multiplayer Online games) have long struggled with this problem – “holding the door” is only a contextually heroic action. Player collision makes gameplay more realistic, but allows some players to limit everyone else’s access to important buildings by loitering in the doorway.

Currently, players’ avatars in Horizon may pass through one another. They can retreat into a safe zone, disappearing from the world. They can also “block” other users – preventing both the blocked and blocking users from seeing one another. Even through a block, they can still see one each other’s nametags – total invisibility created problems I covered here. As such, the current suite of user moderation tools strikes a good balance between empowering users and minimizing new opportunities for misuse.

Finally, given the similarity of the transgression, it is worth recalling Julian Dibbell’s “A Rape in Cyberspace”, one of the first serious accounts of community governance online. In this Village Voice article, Dibbell relates how users of role-playing chatroom LambdaMOO (the best virtual reality to be had in 1993) responded to a string of virtual sexual assaults. After fruitless deliberation, a LambdaMOO coder banned the offending user. After the incident, LambdaMOO established democratic procedures for banning abusive users, and created a “boot” command allowing users to temporarily remove troublemakers.

As the internet has developed content moderation has centralized. Today, users are usually expected to let platforms moderate for them. However, just as in the web’s early days, empowering users remains the best solution to interpersonal abuse. The tools they need to keep themselves safe may be different, but in virtual reality as in role-playing chat, those closest to abuse are best positioned to address it. Users being harassed should not be expected to wait for the mods.

Will Duffield is a Policy Analyst at the Cato Institute

Filed Under: blocking, content moderation, horizon worlds, sexual harassment, user tools, vr
Companies: facebook, meta

Retailers Are Blaming The Internet For A Retail Theft Surge That Might Not Be Happening; Media Is Helping Them Out

from the oh-look,-that-again dept

It's becoming quite a theme: basically every industry is blaming the internet for anything wrong happening in their industry and the legacy media is more than willing to help out. The latest is the supposed "surge" in shoplifting and retail crime. You've probably seen the stories, and maybe the shaky video coverage of the big smash and grab runs at some big San Francisco stores. This is being leveraged by those retailers in a variety of ways, including in a push to roll back policing reforms, but also to attack the internet. We've talked about the problems of the INFORM Act, which is being pushed heavily by large retailers. If you read that letter (sent to Congressional leaders by a bunch of big retailers), it uses those stories of theft to say we need to pass new regulations about internet sales:

As millions of Americans have undoubtedly seen on the news in recent weeks and months, retail establishments of all kinds have seen a significant uptick in organized crime in communities across the nation. While we constantly invest in people, policies, and innovative technology to deter theft, criminals are capitalizing on the anonymity of the Internet and the failure of certain marketplaces to verify their sellers. This trend has made retail businesses a target for increasing theft, hurt legitimate businesses who are forced to compete against unscrupulous sellers, and has greatly increased consumer exposure to unsafe and dangerous counterfeit products.

Of course, if someone takes the time to actually dig into the statistics, it appears that the holiday shoplifting surge narrative mostly falls apart. Obviously, there has been some theft (and a few of those dramatic flash mob style smash and grab jobs), but the data suggests crime continues to mostly fall.

Recent news stories describe a shoplifting surge, but this narrative conflates an array of very different offenses into a single crime wave said to be cresting right now, all over the country, in a frenzy of naked avarice and shocking violence. Smash-and-grabs are awful, but they’re pretty rare (and already very much felonies). Nevertheless, a handful of viral videos and some troubling statistics from retailers and industry groups have set Americans on edge during the year’s most economically essential shopping season, wondering if the mall where they buy their Christmas presents might be next. The deeper you search for real, objective evidence of an accelerating retail crime wave, the more difficult it is to be sure that you know anything at all.

[....]

The first indicator that the theft-wave narrative may not hold water is that stories about it tend to garble terms and numbers. They pair broad statistics about the commonness of shoplifting or larceny of any kind with lurid descriptions of brazen armed robberies (which aren’t included in any shoplifting stats, because they are a different crime entirely) to illustrate a narrowly defined problem: organized retail crime. This is identified as repetitive, mostly nonconfrontational theft for profit, whose perpetrators strive to evade detection and keep each theft strategically below local dollar thresholds for felony larceny. Misdemeanors don’t attract law-enforcement attention, the theory goes, so criminals are able to strike again and again and flip their hauls to fences, who consolidate millions of dollars of stolen goods into inventory for online storefronts, where Amazon and Etsy and eBay shield them from detection and punishment.

And, indeed, the actual stats showed a decrease, and while they don't cover recent months, the author notes, if there is an actual surge, it might be because of this stupid moral panic narrative that's making the rounds making it sound like everyone is doing it:

So far, this dynamic holds true for much of the country, according to FBI statistics. In 2020, the most recent year for which data are available, reports of robbery and larceny fell off a cliff. If we see a big jump in the near future, especially in violent smash-and-grabs, it’s worth asking how much the recent media attention itself contributed to the spike. Research has shown that sensational news coverage can influence potential offenders to adopt highly publicized tactics in copycat crimes.

Of course, it's convenient for retailers to play up these theft stories, because if it leads to laws getting passed that bog down internet retailers, why they just clear a path for these brick-and-mortar stores who haven't adapted to the internet as well.

In fact, as that Atlantic piece by Amanda Mull notes, the National Retail Federation's own survey numbers show that theft really isn't that big of a deal:

Consider “shrink.” That’s the term retailers use to describe inventory losses from any cause—shoplifting, sloppy checkout practices, shipping errors, warehouse mistakes, or simple misplacement—usually expressed as a percentage of total sales. It can be very difficult for stores to determine how any particular piece of inventory was lost, so they are forced to estimate how much different kinds of losses contribute to their bottom line. In both 2019 and 2020, annual surveys of NRF members pegged the industry’s average overall shrink rate at 1.6 percent—for every $100 in sales, an average of $1.60 in inventory was lost. The NRF’s estimate of how much organized retail crime contributes to shrink is $700,000 for every $1 billion in sales, or $0.07 for every $100. Even by the estimates of groups lobbying lawmakers and the public to take the problem seriously, these types of crimes account for a tiny proportion of overall losses, on average. Paperwork errors and self-checkout machines are both far graver threats to inventory management.

But, that's not stopping the retailers from using the narrative that is happily being pushed by the legacy media (possibly inspiring more such theft), as an excuse to try to pass more laws to hinder the internet. Can't let a good false narrative go to waste, I guess.

Filed Under: blame, exaggeration, internet, media, overhype, retail theft, shoplifting, theft