‘Nintendo Power’ Scans Disappeared From The Internet Archive

Trademark

from the nintendon't dept

It was only some weeks back that we were discussing how a group of hobbyists were once again doing the culture preservation work that content creators should be doing in the form of a scan of every single Nintendo Power magazine and uploading it to the Internet Archive. At the time, you could go to the link for the project and view every magazine’s contents in its full antiquated glory. I finished that post off with the following line after ruminating that the view on this by Nintendo should be that this is pure preservation and not some kind of threat to its current business operations:

Hopefully Nintendo can manage to see that as well. Somehow, though, I suspect the lawyers already have pen to paper.

But, as I’m fond of saying, Nintendo is going to Nintendo. If you go to the site for the project now, you’ll see that the content has been replaced with a notice indicating that the content has been taken down. Annoyingly, the text displayed now doesn’t detail out why it’s been taken down, but rather indicates a bunch of possible reasons: TOS violations, a decision by the uploader, etc. Because of that, I can’t say for sure that Nintendo’s lawyers got involved to get this content taken down, but it’s a pretty safe bet. Why?

Well, because the company has done this exact thing before. At that link, you can read a Wired post on how Nintendo took down 140 issues worth of scans, also from the Internet Archive, back in 2016.

The 140+ issues of classic gaming magazine Nintendo Power that were uploaded to the Internet Archive are once again the preserve of physical collectors and forgotten boxes stashed in attics. Nintendo, the original publisher of the title, has had the digital collection pulled.

While no formal announcement has been given on the takedown, Nintendo of America told Polygon that it must “protect our own characters, trademarks and other content” and “the unapproved use of Nintendo’s intellectual property can weaken our ability to protect and preserve it, or to possibly use it for new projects.”

What’s clear here is that either Nintendo requested the content be taken down directly or either the Internet Archive or the uploader did so purely out of fear of Nintendo’s lawyers. Either way, as I’m often wont to do, I am happy to blame Nintendo for this.

And you really do have to keep it in your head that there both is no threat to Nintendo for not figuring out a way to allow this to exist, nor is Nintendo doing anything itself to achieve the same preservation efforts that the upload achieved. It’s not like there’s an official Nintendo site out there where all of this culture is being preserved. If there were, the IA.org scans wouldn’t need to exist.

It’s a net loss for culture, all because Nintendo just can’t stop being Nintendo.

Filed Under: archives, copyright, nintendo power, terms of service, trademark
Companies: nintendo

Devin Nunes Gets Small, Most Likely Temporary, Victory Against MSNBC, While Also Suing CNN Again

Defamation

from the you-don't-need-to-sue-them-all,-devin dept

You might have seen some headlines recently suggesting that former congressional representative and current flailing social media CEO (and serial suer of the media) Devin Nunes had some sort of legal victory over Rachel Maddow and MSNBC. And he did get a very, very small victory while piling up more losses at the same time. Law & Crime (which consistently does excellent work) had a much more accurate headline noting that the court actually dismissed all but one claim in his lawsuit. And you could actually go beyond that. There were three separate statements that were claimed to be defamatory, and two were dismissed outright, and the third actually consisted of three separate factual claims, two of which were also dismissed. So it was basically just one-third of one claim that survived.

And, even that oversells the victory, because the court basically let the case move forward because the one remaining statement of fact wasn’t backed up by a source, even though MSNBC has one. But, the problem was that MSNBC didn’t cite that source in Maddow’s report. And, at this stage of the case, MSNBC can’t bring in additional evidence like that. So, the case moves forward on one tiny part where Maddow/MSNBC could potentially still prevail on a failure to show actual malice. And, even if actual malice was shown, Nunes would still have to show damages caused by this one statement, and, uh, how is he gonna do that? He still got his CEO gig.

Meanwhile, a week and a half earlier, Nunes also sued CNN (again) and Jake Tapper. Remember, Nunes just recently lost another lawsuit against CNN, over a different defamation claim. But apparently he and his lawyer, Steven Biss, believe in a “if at first you don’t succeed, try, try again” strategy. The lawsuit is pretty ridiculous, but we’ll get there.

First, let’s go over the ruling in the MSNBC case. I highly recommend reading the ruling, which is well written, and much more clearly (and concisely!) explained than many other rulings we see. I’ll quote directly from it summarizing the key events at issue:

On December 11, 2019, a package was delivered to the House Permanent Select Committee on Intelligence (“Intelligence Committee” or the “Committee”), of which Nunes was Ranking Member. (2nd Am. Compl’t ¶ 13.) It was addressed to Nunes from Andriy Derkach and was handled solely by Nunes’ staff and delivered, unopened, to the offices of the FBI. (Id.) That same day, Nunes sent a letter to Attorney General William P. Barr advising him of the receipt of the package. (Id.)

On July 29, 2020, the Intelligence Committee held an open business meeting. (Id. at n.5.) During this meeting, Representative Sean Maloney asked Nunes two questions. (Id.) First, Maloney asked if Nunes had received materials from Derkach. (Id.) Second, Maloney asked if, in the event that Nunes had received materials, whether he was prepared to share them with the Committee. (Id.) When asked if he wished to respond to the questions, Nunes declined

In early 2021, the National Intelligence Council then declassified a report that included some of these details, specifically around the packages being sent to Nunes and others. Maddow’s report, in somewhat typical overstated fashion, covered this and made some statements about Nunes:

In the March 18, 2021 broadcast of The Rachel Maddow Show, host Rachel Maddow discussed the declassified DNI Report as part of a longer segment about Derkach, Russian disinformation and election interference.1 (Id.) Maddow referred to the report and discussed the package addressed to Nunes, as well as the interaction between Nunes and Maloney at the Intelligence Committee meeting. (Id.) Maddow said that Nunes had accepted a package from Derkach and refused to answer questions about the package. (Id. ¶ 2.) Maddow also said that Nunes refused to hand the package to the FBI. (Id.)

Now, you’ll probably immediately spot the problem. From all reports, Nunes’s staff did immediately hand over the package to the FBI (and Nunes separately alerted to the Attorney General to it). So, that does seem like a false statement of fact, which could (in theory) be defamatory.

Of course, this is a Nunes/Biss production, so they overclaimed other stuff that they also said was defamatory:

The Complaint alleges that three statements from a segment of the March 18, 2021 episode of The Rachel Maddow Show are false and defamatory. (2d Am. Compl’t ¶ 2.) The statements are as follows:

Statement One: “Andriy Derkach is sanctioned by the U.S. government as a Russian agent. He is singled out by name by the Director of National Intelligence as someone under Vladimir Putin’s direct purview who helped run this organization targeting our election last year. Congressman Nunes accepted a package from him. What was in it?”

Statement Two: “Congressman Nunes has refused to answer questions about what he received from Andriy Derkach. He has refused to show the contents of the package to other members of the intelligence community. He has refused to hand it over to the FBI which is what you should do if you get something from somebody who is sanctioned by the U.S. as a Russian agent.”

Statement Three: “Still, the Republicans have kept Mr. Nunes on as the top Republican on the intelligence committee. How does that stand? How does that stay a thing?”

So, right. Statement one is substantially true. Nunes tried to argue that it wasn’t accurate to say he “accepted” the package, but the judge isn’t having it.

In the Complaint, Nunes confirms that the package was both addressed to him and received by his staff members. (2d Am. Compl’t ¶ 13.) His staff member delivered the package to the FBI. (Id.) And Nunes personally wrote to the Attorney General to advise him of the receipt of the package. (Id.) The statement that Nunes “accepted” a package from Derkach compared with the actual truth as stated in Nunes’s complaint would not have a different effect on the mind of a viewer. Therefore, Statement One is privileged against a defamation claim because, based on the Complaint’s own allegations, it is substantially true.

Statement three is not defamatory. I mean, what even is the false statement of fact in there?

Statement Three cannot be classified as actionable statements of fact or actionable mixed opinion. When weighing the factors, the specific language does not have a precise meaning, is not capable of being proved or disproved, and when considering the context, the average viewer would not reasonably believe the statements to be based on undisclosed facts. See id. at 105. Considering the immediate context of the questions, of political commentary on a political program, such statements and rhetorical questions would not be viewed by a reasonable person as expressing or implying facts about the plaintiff. The Court therefore concludes that Statement Three is privileged as pure opinion and not actionable.

That leaves statement two which the court breaks down into the three separate claims, find that two of them are also substantially true.

The first asserted fact, that Nunes “has refused to answer questions about what he received from Andriy Derkach,” is not actionable as defamation because it is substantially true. As described in the Complaint itself, during the House Intelligence Committee meeting of July 29, 2020, Nunes “stated that he did not wish to respond” to Maloney’s questions both because a response “risked disclosing classified information” and because the questions were a “completely out-of-order, coordinated stunt.” (2d Am. Compl’t ¶ 13 n.5.) A comparison between the complained-of language and the truth as described in Nunes’s complaint would not have a different effect in the mind of a reasonable viewer. To the extent that Nunes asserts defamation based on the statement that he “has refused to answer questions about what he received from Andriy Derkach,” the claim will be dismissed

And, while Nunes argues that claiming he wouldn’t share the contents with the “intelligence community” is false because it was referencing the House Intelligence Committee, which is technically not the intelligence “community” (but rather its overseer), this slight misstatement by Maddow certainly doesn’t rise to the level of defamation:

The Court concludes that a reasonable viewer encountering the statement would not understand the technical distinction between the government entities that formally comprise the intelligence committee and the Intelligence Committee that is tasked with supervising those entities. The speaker also asserted that Nunes “refused to show the contents of the package to other members of the intelligence community.” (2d Am Compl’t ¶ 2; emphasis added.) A reasonable viewer would understand the speaker to be asserting that Nunes himself is personally a “member” of the intelligence community and that the “other members” included his Congressional colleagues. This description is consistent with the events of the Intelligence Committee proceeding. And while the Intelligence Committee is not technically part of the intelligence community, it performs a formal oversight role, and minor inaccuracies are “not serious enough to remove a party’s reportage from the protection of Civil Rights Law §74.” Misek-Falkoff, 300 A.D.2d at 216

So, that’s a lot of dismissed supposedly defamatory statements. All that leaves is the statement about not handing over the info to the FBI. Which, again, is false. But for it to be defamatory against a public figure, Nunes has to show actual malice, which (I will explain yet again) does not just mean that Maddow/MSNBC “dislike” Nunes, but rather they knew that the info was false, or had strong evidence suggesting it was false. This is a high bar, and frankly, I have trouble believing that Nunes clears it. He claims that Maddow/MSNBC knew it was false because there had been a Breitbart report that quoted another congressional representative claiming that Nunes had in fact turned it over to the FBI.

But that supposes that Maddow was familiar with the specifics of the Breitbart report (which is buried in the 18th paragraph). Seems difficult to argue that Maddow had knowledge of falsity based on that, but the court says, at this stage of the game it’s enough to move to the next stage and not dismiss the claim.

MSNBC argued that Maddow’s report was based on a Politico story that quotes an anonymous source saying that the package had not been handed over to the FBI. Notably, that Breitbart article is actually mostly about Republicans claiming that the Politico article in question was the result of a potentially illegal leak from the Democrats about this classified meeting. But, as the court notes, because Maddow didn’t specifically cite the Politico report, it can’t be used, at this stage, to argue against actual malice:

This Politico article is not cited or referenced in the Complaint, nor is it cited or referenced in the segment. Because the article goes beyond the pleadings and the materials integral thereto, it is not properly considered on a motion to dismiss. Goel, 820 F.3d at 559. On this bare record, the Court declines to convert the motion to one for summary judgment.

And, remember, the key difference between the motion to dismiss stage and the summary judgment stage is that with an MSJ, evidence can be submitted. So, this “victory” may not last long at all.

But, this should be a reminder to all journalists: when making statement of fact claims, cite your sources. Turns out it can be the difference between winning a motion to dismiss and a (much more costly) motion for summary judgment.

Anyway, now let’s move on to the Tapper/CNN suit. It’s… strange. It’s about a segment Tapper did about the attack on Paul Pelosi, and the Republicans’ response to the attack, which sometimes included spreading baseless conspiracy theories about it. Incredibly, the complaint lists five statements that it claims are defamatory, and ONLY ONE even mentions Nunes:

1 “He [referring to President Donald Trump], at least, did condemn the attack on Paul Pelosi, as did House Republican Leader Kevin McCarthy, as did Senate Minority Leader Mitch McConnell”

2 “But you know what, far too many other Republicans and Conservative leaders are out there instead spreading insane, offensive and false conspiracy theories, such as the complete and utter lie, the deranged smear that Paul Pelosi and the attacker, the man who hit him in the head with a hammer, were in a sexual relationship”

3 “It’s hard to fathom the kind of mind that hears of a tragedy, like what happened to 82 year-old Paul Pelosi, and decides to traffic in this filth. But, sadly, Donald Trump Jr. is hardly alone. Former Republican Congressman and Chairman of the House Intelligence Committee, Devin Nunes, who now runs Trump’s social media company, Truth Social, shared this Halloween image [link to truth] with the words, ‘at least this guy has his clothes on.’ Nunes also reposted this meme [link to retruth], using a poster for the gay romantic comedy Bros, twisting it into a smear of Paul Pelosi. And, again, the man who tried to bash Paul Pelosi’s head in with a hammer. Words fail.”

4 “What is wrong with these people?”

5 “In addition to being an inhuman and inhumane response to a tragedy, it’s a lie … Pelosi did not know the suspect.”

I mean, point one: I’m impressed at the sheer chutzpah of arguing “what is wrong with these people” is somehow a defamatory statement of fact about Devin Nunes. I mean, Biss’ lawsuits often have these nutty claims of how clear statements of opinion are defamatory, but this one is really up there on the list of most egregious.

And, even the one statement that does mention Nunes, only includes a statement about what Nunes shared on Truth Social. As far as I can tell, Nunes does not deny sharing the material Tapper claims he shared. Instead, Nunes argues that the episode “as a whole” subjected him to ridicule through “juxtaposition and omission of material facts,” but uh, dude, you still need to highlight actual false statements of fact, and the complaint does not get there.

Honestly, this complaint is so bad that it seems like the kind of thing that could lead to sanctions.

Meanwhile, it remains ironic that Nunes leads a social media site that claims to be all about “free speech” while he repeatedly sues critics and commentators for their free speech.

Filed Under: actual malice, defamation, devin nunes, jake tapper, rachel maddow, steven biss
Companies: cnn, msnbc

How KOSA’s ‘Parental Tools’ Mandate Will Almost Certainly Lead To Abuse

Policy

from the congress-needs-to-stop-breaking-tech dept

There is a serious problem in the way many tech-focused bills are drafted these days. Whether it’s a lack of trust or simply a desire to punish, those working on tech-bills are not talking to the right industry people about how things actually work in practice. This leads to simple mistakes like requiring something that seems like a good idea but runs counter to how systems are designed and how they function. When these mistakes are bad enough, they can result in serious security and safety problems.

I previously wrote a post explaining how issues in the drafting of the Kids Online Safety Act will likely result in harm to LGBTQ and other communities if State Attorneys General seek to exploit it for political purposes (something already being encouraged). In going back through the text, I found another significant problem that could impact the security and safety of users. There is a section that requires covered platforms to develop parental tools that would apply to minor accounts, and enable them by default if they believe a user is a child. The problem is that there seems to be little thought into how this would actually be implemented.

This might make sense if we were talking about devices. The assumption is that a parent buys the device and assists in the setup. The device can offer the option to parents at that time and explain the process in the manual. If someone is being unfairly restricted by the device (i.e. not a minor) they most likely can buy their own device. It may also make sense for most paid services, like Netflix or Amazon Prime. There, the subscriber can set up a primary account with controls over sub-accounts. Again, an unfairly restricted person could hopefully get a separate primary account.

However, there are a lot of services where there is no initial contact point with the presumptive parent. Email, for example, is generally a free service that anyone can sign up for. People can then sign up for many other services for free using no more than an email address. Most social media platforms are free, as are most messaging applications and community forums. Most video game distribution platforms, like Epic Games, are free, and many video games, like Fortnite, run on a freemium model. This creates a lot of problems. How do these platforms identify parents and offer them parental tools? How will minors’ accounts be flagged? How will those reaching the age of majority be able to end parental control? How will platforms prevent abuse of these tools by bad actors? How will they retroactively activate parental tools on existing accounts?

Parental tools are by necessity something that enables one user to control another user. This control has to be against the wishes of the minor user when necessary. It also often comes with some degree of surveillance so that the parent knows when the minor may be in trouble. The parental tools mandated in KOSA fit this description. The tools have to allow the parent to control privacy/account settings, restrict purchases, track time on the platform, and other “control options that allow parents to address the harms described in section 3(b).” This last requirement likely has to include some surveillance, because the harms described in section 3(b) are things like bullying, harassment, and sexual exploitation that are most likely to occur in communications, including private communications.

Needless to say, access to these parental tools comes with a good deal of power over accounts that may be lifetime accounts that become very important to users. This puts covered platforms in a difficult situation, because they are required to do something that, if done incorrectly, puts people at risk. Here are some plausible scenarios that could cause problems:

• A minor’s parents are divorced. One is abusive and has lost custody rights. The abusive parent requests or otherwise obtains parental control over the minor’s account.
• A trans teen leaves an unsupportive home at the age of majority. The abusive parents submit a claim to the company stating the teen is still a minor and requesting control over their account.
• An abusive ex to a custodial parent submits a claim to a platform that they are a custodial step-parent of a minor and requests control as a way to continue their abuse of either the parent or the minor.
• An abusive ex (or any other kind of creep) fabricates information that a user is a minor and claims to be a custodial parent, asking for control over the account as a means to stalk the user.
• A bad actor, such as a groomer or a hacker, improperly gains control of an account through the parental tools and uses that control to advance their nefarious activities.

Each of these scenarios creates a tough situation for companies. How do they comply with the law when the information needed to do so (i.e. custody rights) is difficult to obtain and sorting through these issues is time intensive and expensive? Platforms rarely require proof of identity and age, and ignoring the privacy concerns, requiring platforms to gather this information still doesn’t answer the question of custody rights.

One answer might be to just create the tools and put them in an account setting so that a knowledgeable parent could log on with their child and set everything up, but otherwise it would go unused. But the law seems to prevent that. First, there is a requirement that the parental tools be enabled by default if the platform reasonably believes a user is a child. Second, there is a no-dark-patterns section that would probably apply because the requirement is for “readily-accessible and easy-to-use” parental tools. The law appears to require either an affirmative offer or a way of gaining parental control over a minor’s account even if it is against their wishes. For example, maybe a parent wants to restrict a minor’s Fortnite time but they refuse to allow the parent access to their account, either logging out when the parent is around or playing at a friend’s instead.

The problem all comes down to a simple question: how are platforms supposed to offer the parental tools? Everything flows from that. Let’s assume an account gets flagged as a child user, and the most restrictive required parental tools are enabled by default. What happens next? Is the account locked until a parent is present? How does the platform know that it’s a parent? How does the platform know it’s a parent with custody rights? Will the “parent” have to walk through a tool setup before the account works again? How will mistakenly flagged accounts be cleared? Will they have to submit a driver’s license? Pay stub? Mail? How will the platform know those documents aren’t forged? Which way does the platform need to err in order to be reasonable under the law? In favor of enabling control over users to prevent harm to children, or in favor of not allowing control to prevent harm by bad actors? And do the tools let the parent log in to the child’s full account, and therefore have access to everything, or is it a separate login that displays only the parental tools and thereby allows the child some degree of privacy?

Offering parental tools creates a cascade of tough questions that need to be thoroughly thought through so that such systems can be safely designed. Some covered platforms are structured in a way where this can be done relatively easily. For others it may be impossible. KOSA is completely blind to that, and seems to be drafted under the assumption that this is all quite doable by a wide range of internet connected platforms and services. KOSA is well-intentioned, but it’s simply not drafted with these security and safety concerns in mind. It shouldn’t pass.

Matthew Lane is a Senior Director at InSight Public Affairs.

Filed Under: abuse, kids online safety, kosa, parental tools

American Journalist First To Sue NSO Group Directly For Targeting His Phone

Legal Issues

from the fuck-around,-find-out dept

NSO Group is objectively awful. For years — with the assistance of the Israeli government — NSO sold to whoever wanted powerful phone exploits to deploy against targets. Ostensibly sold to investigate violent crimes and acts of terrorism, the less-than-savory customers of NSO flipped the script, deploying zero-click malware that allowed government employees to target journalists, critics, activists, human rights lawyers, and anyone else (INCLUDING EX-WIVES) that made their lives uncomfortable.

NSO has seen its fortunes fall. It has seen VCs, normally immune to public opinion, cut and run. It has been investigated, sanctioned, and pilloried. It lives on somehow, but it’s hardly the force it once was.

It has also been sued. And not by entities NSO might feel like blowing off. It tried this quote/endquote “tactic” for a bit, but Apple and Meta ain’t nothin’ to fuck with, to quote the WuTang Clan. It’s now facing another lawsuit, as Ronan Farrow reports for the New Yorker. An American journalist targeted by NSO malware wants the company to be held accountable for making his life miserable and interfering with his reporting.

Roman Gressier, an American journalist working for the Salvadoran news outlet El Faro, spent the spring of 2021 in his small, dorm-like apartment outside the capital. He was twenty-six, and had recently moved to San Salvador to pursue his long-standing ambition of working for El Faro, one of Central America’s foremost news organizations. Breaking a string of stories documenting corruption and malfeasance in the administration of El Salvador’s populist President, Nayib Bukele, El Faro has become a leading source of accountability in Central American media—and a source of frustration to Bukele.

Obviously, this was a problem for the El Salvadoran government. Fortunately, it had access to NSO Group malware. That made this American journalist a target for government oppression, even if Gressier wasn’t actually a citizen of the country he reported on.

Gressier is one of at least thirty-five journalists and civil-society members hacked with Pegasus in El Salvador between July, 2020, and November, 2021, according to the analysis by Citizen Lab, which was verified by Amnesty International. The hacking campaign comprised at least two hundred and sixty Pegasus attacks. Because it is more difficult to confirm Pegasus infections on Android phones, which predominate in El Salvador, experts said that the true number was likely far higher.

In El Salvador, targeting of journalists with NSO malware happens all the time.

“It’s a shitty feeling,” Óscar Martínez, El Faro’s executive editor, whose phone was infected with Pegasus forty-two times between July, 2020, and October, 2021, told me. “Sources, they were very upset with me. And they have the right to be. They just trusted me. And I failed them.”

In response, Gressier has sued NSO Group. Assisted by the Knight First Amendment Institute, Gressier is hoping the US court system will allow him to hold NSO Group accountable for violating his rights.

Heading up what could become a class action lawsuit [PDF], Gressier alleges NSO-enabled phone hacking has pretty much destroyed the lives of foreign (and foreign-based) journalists.

The Pegasus attacks have profoundly disrupted Plaintiffs’ lives and work. The attacks have compromised Plaintiffs’ safety as well as the safety of their colleagues, sources, and family members. The attacks have deterred some sources from sharing information with Plaintiffs. Some Plaintiffs have been diverted from pressing investigative projects by the necessity of assessing which data was stolen, and of taking precautions against the possibility that the stolen data will be exploited. Plaintiffs have also had to expend substantial resources to protect their devices against possible future attacks, to ensure their personal safety, and to address serious physical and mental health issues resulting from the attacks. The attacks have undermined the security that is a precondition for the independent journalism that El Faro strives to provide its readers, as well as the ability of El Faro’s readers, including those in the United States, to obtain independent analysis of events in Central America.

For better or worse, the litigation attack vector is the CFAA, an oft-abused law that often allows plaintiffs to silence pesky security researchers or punish people who use their sites and services in ways they didn’t expect.

That being said, there’s no arguing the threat NSO malware poses to journalists. NSO historically hasn’t shown much restraint when it comes to selling licenses, courting a large number of known human rights abusers. Unsurprisingly, the acquisition of malware by these governments has resulted in more human rights violations.

According to the Pegasus Project, a collaboration of more than eighty journalists from seventeen media organizations in ten countries, at least 180 journalists from twenty countries have been the victims of Pegasus attacks directed by authoritarian or rights-abusing governments. For example, Saudi authorities used Pegasus to surveil family members and close associates of journalist Jamal Khashoggi—whom Saudi agents brutally murdered in 2018—as well as other Saudi activists, an Amnesty International researcher, and an American New York Times journalist who has reported extensively on the country. Morocco used Pegasus to spy on journalist Omar Radi. Mexican officials used Pegasus to surveil journalists and lawyers investigating corruption and human rights abuses in the country. Hungarian Prime Minister Viktor Orbán also used Pegasus to surveil journalists, lawyers, and social activists.

The lawsuit details multiple targetings of El Faro journalists. As it pertains to the US journalist, Gressier argues this targeting not only violates the CFAA but also violates California’s anti-hacking law. Unfortunately, it’s going to be difficult to prove targeting that occurred while Gressier was located in El Salvador violates state law (since it likely involved a foreign government entity operating domestically). As for the CFAA, NSO is certain to claim this law does not govern its malware, nor its foreign customers’ deployments. And it will no doubt take another pass at getting a court to agree with its sovereign immunity assertions, given that the infections of journalists’ phones were performed by government operatives.

Ahead of its filed responses to this lawsuit, NSO has issued yet another nonsensical response to these extremely credible accusations:

In a statement, an NSO spokesperson said that the watchdog groups “repeatedly recycle each other’s reports and knowingly release speculative, inaccurate and incomplete reports to the media, including to the New Yorker.” NSO claims that the groups’ analyses “rely on probabilities and circumstantial protocols rather than on actual forensics and evidence” and that “Citizen Lab and Amnesty are unable to differentiate between NSO’s tools and those of other cyber intelligence companies.”

Ah, so the investigative work of Citizen Lab is just “fake news.” OK. This is the verbal sound of flailing by a company that never bothered to care who it sold to until a lengthy negative news cycle forced it to start doing something about the problems it created. And, despite plenty of evidence pointing to misuse of NSO malware, NSO still thinks it can bluster its way past intense investigations by pretending everyone is lying about it and its abhorrent customer base. Good luck with that in court.

Filed Under: el salvador, journalism, malware, pegasus, roman gressier, spyware, surveillance
Companies: nso group

Daily Deal: The 2022 Complete Renewable Energy Engineer Preparation Bundle

Deals

from the good-deals-on-cool-stuff dept

The 2022 Complete Renewable Energy Engineer Preparation Bundle features 12 courses to help you learn all about renewable energy sources and how to design, develop, and build renewable energy technologies. Courses cover wind turbines, solar energy, ETAP software, and more. It’s on sale for $40.

Note: The Techdirt Deals Store is powered and curated by StackCommerce. A portion of all sales from Techdirt Deals helps support Techdirt. The products featured do not reflect endorsements by our editorial team.

Filed Under: daily deal

How Will Elon Feel When He Realizes Congress Is Trying To Force Him To Throw Free Money At Newspapers He Hates?

Policy

from the pay-attention-elon dept

We’ve written many times about the many problems of the JCPA (the Journalism Competition and Preservation Act). As noted, the bill is a really sketchy bit of corruption: creating a link tax to force internet companies to funnel money to news organization owners for… sending them traffic. Everything about the JCPA is wrong and broken. Supporters insist it’s not a link tax nor a change to copyright law, but it is both. The fundamental argument in the bill is that large sites that link to news organizations need to pay for a license for “access.” But access to what? There’s no license for access for content put on the web for free. It’s just… the web.

The bill also has a bunch of nasty features. The main mechanism by which it works is that it allows “news organizations” to join together to “negotiate” for such a license. The collective bargaining part isn’t such a big deal, other than the fact that it’s collective bargaining over something that is inherently free: the right to link and send traffic to a website. But, as part of the bill, sites that can’t reach a negotiated agreement to pay up have to go to baseball-style arbitration, where each side submits a number and the arbitrator chooses which one wins. So sites can’t just say “we’re not paying.” They may be forced to.

Furthermore, this will allow today’s worst disinformation providers to demand free cash from tech companies and, because the bill forbids any sort of “retaliation,” it effectively allows the worst propagandists to force sites like Google and Facebook to carry and promote their links, because anything else will be seen as retaliation. So the bill will help give free money to nonsense peddlers.

And, contrary to the claims of supporters of the bill, it won’t help journalism either. Most of the money will go to large private equity firms that have been buying up regional newspapers, firing most of the employees, setting up a barebones staff, and taking in the pretty significant regular cash flow from long time subscribers who just continue subscribing via inertia. Do we really think those private equity folks are going to take this money and invest in better journalism, or just pocket it?

Anyway, as we noted yesterday, reports are that some Congressional leaders (namely Senators Chuck Schumer and Mitch McConnell) have cut a deal to include the JCPA in the must-pass NDAA, despite this bill having literally nothing to do with national defense (the purported purpose of the NDAA).

Lots of organizations have put out statements and/or action tools to protest this. Public Knowledge released a big group letter. Fight for the Future has a tool to contact Congress about this. Chamber of Progress has a really nice tool for sending a letter to Congress as well, while also highlighting how the law would help fund nonsense peddlers. CCIA also has some TV ads explaining the problems with the bill.

It’s unclear how the companies would react. While the bill does effectively say that sites cannot punish websites for demanding payment, it does seem like sites could just stop linking to news. And Meta/Facebook is already threatening to do just that:

“If Congress passes an ill-considered journalism bill as part of national security legislation,” Meta said in a statement tweeted by spokesman Andy Stone, “we will be forced to consider removing news from our platform altogether rather than submit to government-mandated negotiations that unfairly disregard any value we provide to news outlets through increased traffic and subscriptions.”

This is not an idle threat. When similar legislation passed in Australia, the company blocked links to news stories for a few days, until the Australian government made some concessions in the law. While many argued that this step backfired for Facebook, I still don’t understand how. The company was only responding to the incentives placed before it. Of course, I’m not sure if Google could or would follow suit and block links to news sites, because that would be a huge mess for the entire internet.

And then there’s the question of Twitter. Technically, it does not seem that Twitter currently meets the requirements to be subject to the law, but as with so many of these laws, they base the requirements on statistics that are not entirely easy to determine. But, given Musk’s claims that he plans to have a billion users by 2024, that would trigger the law — meaning that Elon would then be forced to start paying news organizations.

That seems particularly interesting given Musk’s pretty vocal hatred for mainstream news organizations and his stated belief that users on Twitter can effectively replace them. Yet, under this law, should it pass, Musk would be forced to first negotiate with those media organizations and then pay them for merely sending traffic to them.

Of course, if Musk had a functioning policy and communications department he might be paying attention to all this and could speak out, like Meta did. Instead, he’s mostly fired them all and is focused on promoting culture war nonsense.

Filed Under: elon musk, jcpa, journalism, link tax, news, subisides
Companies: twitter

Adams Administration Finally Gets Around To Admitting They Killed NYC’s Ambitious Broadband Plan

Broadband

from the do-not-pass-go,-do-not-collect-$200 dept

Back in 2020, New York City officials unveiled an aggressive plan to revolutionize broadband in the city. The centerpiece of this Internet Master Plan involved building a $156 million open access fiber network that competitors could easily join at low cost, driving some much needed competition — and lower rates, faster speeds, and better coverage — to New York City residents.

It wasn’t meant to be.

Earlier this year, Mayor Eric Adams announced that the city would be “pausing” the initiative. In reality, folks who’d been working on the project for years told me repeatedly that the most ambitious portion of the plan — actively challenging the city’s telecom monopolies with an open access fiber network — was killed off without any consultation with the experts who crafted it.

This week the Adams administration finally got around to admitting it had killed NYC’s ambitious broadband plan:

After Gothamist received a tip the project had been canceled, officials from the city’s Office of Technology and Innovation (OTI) confirmed the decision on Nov. 29 — about a year after the de Blasio administration announced it had chosen a dozen businesses — including a handful owned or led by women or people of color — to spearhead the effort. The cancellation has not been publicly announced, but city officials said those businesses were informed sometime in November.

Several consultants and regional ISPs told me they were very late in the planning and implementation portion of the program, which had greatly upset regional NYC monopolies.

What did the city do instead of spending $156 million on an open access fiber network? Well, for one, it embraced a partnership with Charter (Spectrum, a company that almost got kicked out of New York State for lies and substandard service) that involves paying the monopoly $90 million over three years to temporarily deliver cheaper broadband to around 400,000 low income housing project users.

As opposed to $156 million on an open access fiber network that would have driven numerous, local ISPs to compete in layers, driving down costs for those in range… permanently.

Folks in positions of power from both U.S. parties really love doing this thing where they throw subsidies at the same regional monopolies responsible for crushing competition and driving up prices, then act confused when this convoluted, temporary relief doesn’t fix the actual, full problem.

Our recent Techdirt/Copia report on America’s broadband problem discussed at great length how the solution to the digital divide involves standing up to telecom monopolies and backing the creation of open access fiber networks by a growing coalition of cooperatives, municipalities, utilities, and public/private partnerships.

But doing this requires standing up to telecom monopolies that are not only politically powerful, but bone-grafted to our intelligence gathering and first responder networks. So what captured policymakers from both parties tend to do instead is something best described as… theater. Talk a lot about the importance of bridging the digital divide, but never stand up to the monopolies responsible for it.

Filed Under: broadband, competition, digital divide, eric adams, high speed internet, low income, nyc

Law Enforcement Is Extracting Tons Of Data From Vehicle Infotainment Systems

(Mis)Uses of Technology

from the four-wheeled-informants dept

For years, cars have collected massive amounts of data. And for years, this data has been extraordinarily leaky. Manufacturers don’t like to discuss how much data gets phoned home from vehicle systems. They also don’t like to discuss the attack vectors these systems create, either for malicious hackers or slightly less malicious law enforcement investigators.

The golden age of surveillance definitely covers cars and their infotainment systems. A murder investigation had dead-ended until cops decided to access the on-board computers in the victim’s truck, which led investigators to the suspect nearly two years after the investigation began.

And whatever investigators can’t access themselves will be sold to them. The Ulysses Group, a data broker with several government contracts, told government agencies in early 2021 it had access to location data pulled from vehicles that could be delivered “in near real time.”

Security researchers have uncovered a vulnerability that somewhat inadvertently exposes just how much access law enforcement agencies can pull from on-board systems. A flaw in satellite radio provider SiriusXM’s system allowed anyone to basically hijack a car (turn on the ignition, lock doors, etc.) using nothing but the VIN. This hack also gave them access to personal data stored in the car, along with other data collected by SiriusXM, like speed, brake use, and door status (open/closed).

While this particular flaw only affected Hondas and Nissans, similar payloads of data are only a hack/forensic scrape away from being harvested by law enforcement on demand, as Thomas Brewster reports for Forbes.

The hack highlighted a weakness in modern vehicles’ internet-connected systems, in particular those that track vehicle use and location, while hooking up to drivers’ cellphones and sucking in user data. They’re the same technologies that are regularly being exploited by federal law enforcement agencies, with immigration and border cops investing more than ever before on tools that extract masses of data—from passwords to location—from as many as 10,000 different car models.

10,000 car models is a tasty target for hackers and cops alike. The near-omnipresence of infotainment systems that link with drivers’ phones make nearly any car a potential source of evidence (or, in the case of malicious hackers, a one-stop shop for personal data).

Federal agencies are definitely making use of this data source, according to court documents.

In a recent search of a 2019 Dodge Charger near the Mexican border, a patrol agent wrote that infotainment systems—those that provide GPS, remote control and entertainment features—were especially useful to government investigators. They could provide information on a suspect’s location, email addresses, IP addresses and phone numbers…

Another vehicle system search — this one performed by the ATF — was accompanied by the same claim: infotainment systems not only give investigators access to useful data, but could also reveal user passwords. This (unverified) claim echoed the one made by the CBP agent in regards to the search of the Dodge Charger. What’s undeniable is the fact that investigators are working around phone encryption (and, perhaps, cell phone search warrants) by accessing phone data via connected infotainment systems, rather than trying to access (possibly locked) phones themselves.

It all adds up to real money for companies like Maryland-based Berla, which sells its iVe forensic extraction tool to federal law enforcement agencies.

According to government contract records, in August CBP spent over $380,000 on iVe, nearly eight times its previous single biggest purchase of $50,000 from 2020. ICE, which has been buying Berla’s tools and trainings since 2010, spent $500,000 on iVe in September, well over twice its previous record of $200,000. In a May 2022 contract, CBP specifically asked for “vehicle infotainment forensic extraction tools, licenses, and training” from Berla.

We’ll probably have to wait for a challenge of these searches to learn more details about what the government is obtaining from in-car systems and what judicial paperwork it’s using to perform these searches. Just because it’s technically in “plain view” doesn’t mean a computer storing massive amounts of data should be considered the equivalent of contraband found laying on a backseat or stashed in the trunk. Like cell phones, the search of a connected infotainment system can reveal far more about a person than a search of their home. Hopefully, someone in the judicial system is keeping an eye on these searches and pushing back when warrant affidavits ask for far more than the government is entitled to obtain.

Filed Under: cars, data brokers, hacking, infotainment, privacy
Companies: siriusxm

Media Organizations Ask US To Drop Charges Against Assange

Journalism

from the they're-right dept

While it seems difficult for some to balance these things, it remains entirely possible to think that Julian Assange is, generally speaking, a horrible human being, who was likely easily played like a fiddle by foreign nation states looking to play influence games in other nations… and that the US’s charges against him remain absolute bullshit and a threat to freedom of the press. That’s basically the position we’ve held since day one.

Recently a bunch of giant news organizations appeared to feel similarly and sent a letter to the US government saying that the DOJ should drop its case against Assange. From the letter:

This group of editors and publishers, all of whom had worked with Assange, felt the need to publicly criticise his conduct in 2011 when unredacted copies of the cables were released, and some of us are concerned about the allegations in the indictment that he attempted to aid in computer intrusion of a classified database. But we come together now to express our grave concerns about the continued prosecution of Julian Assange for obtaining and publishing classified materials.

The Obama-Biden administration, in office during the WikiLeaks publication in 2010, refrained from indicting Assange, explaining that they would have had to indict journalists from major news outlets too. Their position placed a premium on press freedom, despite its uncomfortable consequences. Under Donald Trump however, the position changed. The DoJ relied on an old law, the Espionage Act of 1917 (designed to prosecute potential spies during world war one), which has never been used to prosecute a publisher or broadcaster.

This indictment sets a dangerous precedent, and threatens to undermine America’s first amendment and the freedom of the press.

Obtaining and disclosing sensitive information when necessary in the public interest is a core part of the daily work of journalists. If that work is criminalized, our public discourse and our democracies are made significantly weaker.

The letter was signed by the New York Times, the Guardian, Le Monde, Der Spiegel, and El Pais.

That’s the crux of the concern there. Most of the actions described in the indictment would apply equally to many investigative reporters and their employers. And they are core journalism techniques that deserve protection. Criminalizing basic investigative journalism, including the publishing of leaked documents in the public interest would have tremendously dangerous consequences at a time when we need more investigative reporting than ever before.

Filed Under: doj, journalism, julian assange, leaks, reporting
Companies: ny times, the guardian, wikileaks