The Linkielist

Linking ideas with the world

The Linkielist

Consumer orgs ask world’s competition watchdogs: Are you really going to let Google walk off with all Fitbit’s data?

Twenty consumer and citizen rights groups have published an open letter [PDF] urging regulators to pay closer attention to Google parent Alphabet’s planned acquisition of Fitbit.

The letter describes the pending purchase as a “game-changer” that will test regulators’ resolve to analyse how the vast quantities of health and location data slurped by Google would affect broader market competition.

“Google could exploit Fitbit’s exceptionally valuable health and location datasets, and data collection capabilities, to strengthen its already dominant position in digital markets such as online advertising,” the group warned.

Signatories to the letter include US-based Color of Change, Center for Digital Democracy and the Omidyar Network, the Australian Privacy Foundation, and BEUC – the European Consumer Organisation.

Google confirmed its intent to acquire Fitbit for $2.1bn in November. The deal is still pending, subject to regulator approval. Google has sought the green light from the European Commission, which is expected to publish its decision on 20 July.

The EU’s executive branch can either approve the buy (with or without additional conditions) or opt to start a four-month investigation.

The US Department of Justice has also started its own investigation, requesting documents from both parties. If the deal is stopped, Google will be forced to pay a $250m termination fee to Fitbit.

Separately, the Australian Competition and Consumer Choice Commission (ACCC) has voiced concerns that the Fitbit-Google deal could have a distorting effect on the advertising market.

“Buying Fitbit will allow Google to build an even more comprehensive set of user data, further cementing its position and raising barriers to entry for potential rivals,” said ACCC chairman Rod Sims last month.

“User data available to Google has made it so valuable to advertisers that it faces only limited competition.”

The Register has asked Google and Fitbit for comment. ®

Updated at 14:06 UTC 02/07/20 to add

A Google spokesperson told The Reg: “Throughout this process we have been clear about our commitment not to use Fitbit health and wellness data for Google ads and our responsibility to provide people with choice and control with their data.

“Similar to our other products, with wearables, we will be transparent about the data we collect and why. And we do not sell personal information to anyone.”

Source: Consumer orgs ask world’s competition watchdogs: Are you really going to let Google walk off with all Fitbit’s data? • The Register

Purism’s quest against Intel’s Management Engine black box CPU now comes in 14 inches

This latest device succeeds the previous Librem 13 laptop, which ran for four generations, and includes a slightly bigger display, a hexa-core Ice Lake Intel Core i7 processor, gigabit Ethernet, and USB-C. As the name implies, the Librem 14 packs a 14-inch, 1920×1080 IPS display. Purism said this comes without increasing the laptop’s dimensions thanks to smaller bezels. You can find the full specs here.

Librem 14

Crucially, it is loaded with the usual privacy features found in Purism’s kit such as hardware kill switches that disconnect the microphone and webcam from the laptop’s circuitry. It also comes with the firm’s PureBoot tech, which includes Purism’s in-house CoreBoot BIOS replacement, and a mostly excised Intel Management Engine (IME).

The IME is a hidden coprocessor included in most of Chipzilla’s chipsets since 2008. It allows system administrators to remotely manage devices using out-of-band communications. But it’s also controversial in the security community since it’s somewhat of a black box.

There is little by way of public documentation. Intel hasn’t released the source code. And, to add insult to injury, it’s also proven vulnerable to exploitation in the past.

Source: Purism’s quest against Intel’s Management Engine black box CPU now comes in 14 inches • The Register

Facebook says 5,000 app developers got user data after Cambridge Analytica scandal cutoff date

The company said that it continued sharing user data with approximately 5,000 developers even after their application’s access expired.

The incident is related to a security control that Facebook added to its systems following the Cambridge Analytica scandal of early 2018.

Responding to criticism that it allowed app developers too much access to user information, Facebook added at the time a new mechanism to its API that prevented apps from accessing a user’s data if the user did not use the app for more than 90 days.

However, Facebook said that it recently discovered that in some instances, this safety mechanism failed to activate and allowed some apps to continue accessing user information even past the 90-day cutoff date.

[…]

“From the last several months of data we have available, we currently estimate this issue enabled approximately 5,000 developers to continue receiving [user] information,” Papamiltiadis said.

The company didn’t clarify how many users were impacted, and had their data made available to app developers even after they stopped using the app.

Source: Facebook says 5,000 app developers got user data after cutoff date | ZDNet

Microsoft is forcing Edge on Windows users with a malware-like install

If I told you that my entire computer screen just got taken over by a new app that I’d never installed or asked for — it just magically appeared on my desktop, my taskbar, and preempted my next website launch — you’d probably tell me to run a virus scanner and stay away from shady websites, no?

But the insanely intrusive app I’m talking about isn’t a piece of ransomware. It’s Microsoft’s new Chromium Edge browser, which the company is now force-feeding users via an automatic update to Windows.

Seriously, when I restarted my Windows 10 desktop this week, an app I’d never asked for:

  1. Immediately launched itself
  2. Tried to convince me to migrate away from Chrome, giving me no discernible way to click away or say no
  3. Pinned itself to my desktop and taskbar
  4. Ignored my previous browser preference by asking me — the next time I launched a website — whether I was sure I wanted to use Chrome instead of Microsoft’s oh-so-humble recommendation.

Did I mention that, as of this update, you can’t uninstall Edge anymore?

It all immediately made me think: what would the antitrust enforcers of the ‘90s, who punished Microsoft for bundling Internet Explorer with Windows, think about this modern abuse of Microsoft’s platform?

But mostly, I’m surprised Microsoft would shoot itself in the foot by stooping so low, using tactics I’ve only ever seen from purveyors of adware, spyware, and ransomware. I installed this copy of Windows with a disk I purchased, by the way. Maybe I’m old-fashioned, but I like to think I still own my desktop and get to decide what I put there.

That’s especially true of owners of Windows 7 and Windows 8, I imagine, who are also receiving unwanted gift copies of the new Edge right now:

Source: Microsoft is forcing Edge on Windows users with a spyware-like install – The Verge

The internet becomes trademarkable, sort of, with near-unanimous Supreme Court ruling on Booking.com

The internet’s domain names have become potentially trademarkable following a decision by the US Supreme Court today that Booking.com can in fact be registered with America’s Patent and Trademark Office (PTO) – against officials’ objections.

The near-unanimous decision [PDF] – Justice Stephen Breyer was the sole rebel – went against the PTO’s legal arguments that adding “.com” to a generic term was like adding “company” to a word and so “conveys no additional meaning that would distinguish [one provider’s] services from those of other providers.”

The Supreme Court disagreed; at some length. It agreed with both the district court and the appeals court that “consumers do not in fact perceive the term ‘Booking.com’ that way.” It cited as a key piece of evidence a survey that showed 75 per cent of respondents thought ‘Booking.com’ was a brand name, whereas just 24 per cent believed it was a generic name.

It didn’t help that the PTO hasn’t followed its own argument in the past, with the court noting trademark registration #3,601,346 for Art.com and #2,580,467 for Dating.com. If the decision went against Booking.com, the Supreme Court reasoned, then existing approved trademarks would “be at risk of cancellation.” But it was also scathing in its assessment that “we discern no support for the PTO’s current view in trademark law or policy.”

The same survey that showed 75 per cent of people felt Booking.com was a brand however also revealed that only 33 per cent felt “Washingmachine.com” was a brand whereas 61 per cent though it was generic. And that subjective measurement is likely to prove to be a major headache for the PTO in deciding on what presumably will now be a rush of .com trademark applications.

Source: The internet becomes trademarkable, sort of, with near-unanimous Supreme Court ruling on Booking.com • The Register

Talk about the fox guarding the hen house. Comcast to handle DNS-over-HTTPS for Firefox-using subscribers

Comcast has agreed to be the first home broadband internet provider to handle secure DNS-over-HTTPS queries for Firefox browser users in the US, Mozilla has announced.

This means the ISP, which has joined Moz’s Trusted Recursive Resolver (TRR) Program, will perform domain-name-to-IP-address lookups for subscribers using Firefox via encrypted HTTPS channels. That prevents network eavesdroppers from snooping on DNS queries or meddling with them to redirect connections to malicious webpages.

Last year Comcast and other broadband giants were fiercely against such safeguards, though it appears Comcast has had a change of heart – presumably when it figured it could offer DNS-over-HTTPS services as well as its plain-text DNS resolvers.

At some point in the near future, Firefox users subscribed to Comcast will use the ISP’s DNS-over-HTTPS resolvers by default, though they can opt to switch to other secure DNS providers or opt-out completely.

[…]

Incredibly, DNS-over-HTTPS was heralded as a way to prevent, among others, ISPs from snooping on and analyzing their subscribers’ web activities to target them with adverts tailored to their interests, or sell the information as a package to advertisers and industry analysts. And yet, here’s Comcast providing a DNS-over-HTTPS service for Firefox fans, allowing it to inspect and exploit their incoming queries if it so wishes. Talk about a fox guarding the hen house.

ISPs “have access to a stream of a user’s browsing history,” Marshall Erwin, senior director of trust and security at, er, Mozilla, warned in November. “This is particularly concerning in light of the rollback of the broadband privacy rules, which removed guardrails for how ISPs can use your data. The same ISPs are now fighting to prevent the deployment of DNS-over-HTTPS.”

Mozilla today insisted its new best buddy Comcast is going to play nice and follow the DNS privacy program’s rules.

Source: Talk about the fox guarding the hen house. Comcast to handle DNS-over-HTTPS for Firefox-using subscribers • The Register

tens of thousands of mobile numbers of 50+ year olds sold for whatsapp fraud

Names, adresses and mobile numbers have been sold for fraud using WhatsApp. Most of these numbers come from callcentres, mainly those selling energy contracts. The fresher a lead is, the more they are worth: betwween 25 cents and 2 euros. The money is usually transferred through mules, who keep a percentage of the proceeds.

Source: ’06-nummers van tienduizenden vijftigplussers doorverkocht voor WhatsAppfraude’ – Emerce

Microsoft Edge Accused of Sneakily Importing Firefox Data on Windows 10

In the case of Firefox users, some discovered that the new default Windows 10 browser, which is shipped to their devices via Windows Update, sometimes imports the data from Mozilla’s application even if they don’t give their permission.

Some of these Firefox users decided to kill the initial setup process of Microsoft Edge, only to discover that despite the wizard shutting down prematurely, the browser still copied data stored by Mozilla’s browser.

Several users confirmed on reddit that this behavior happened on their computers too.

Silent data importing

“Love rebooting my computer to get treated to a forced tour of a browser I’m not going to use that I have to force close through the task manager to escape, and then finding out it’s been copying over my data from Firefox without permission,” one user explains.

“Unless you close it via task manager instead of doing the forced setup, in which case it copies your data anyway, and the worst part is most people will never know what it’s doing because they’ll never open it again. I only reopened it because I noticed it automatically signed me into the browser as it was closing and wanted to sign out before not touching it again, at which point I discovered it had already copied my Firefox data over despite the fact I didn’t go through the setup process,” someone else explains.

Microsoft has remained tight-lipped on this, so for the time being, it’s still not known why Edge imports Firefox data despite the initial wizard actually killed off manually by the user.

Users who don’t want to be offered the new Edge on Windows Update can turn to the dedicated toolkit that Microsoft released earlier this year, while removing the browser is possible by just uninstalling the update from the device.

Source: Microsoft Edge Accused of Sneakily Importing Firefox Data on Windows 10

Google isn’t even trying to not be creepy: ‘Continuous Match Mode’ in Assistant will listen to everything until it’s disabled

Google has introduced “continuous match mode” for apps on its voice-powered Assistant platform, where it will listen to everything without pausing. At the same time it has debuted related developer tools, new features, and the ability to display web content on its Smart Display hardware using the AMP component framework.

The Chocolate Factory has big plans for its voice assistant. “We consider voice to be the biggest paradigm shift around us,” said director of product Baris Gultekin, speaking at the Voice Global summit, where the new features were introduced.

The goal is “ambient computing”, where you can interact with the big G anywhere at any time, so pervasively that you do not notice it. Voice interaction is a key part of this since it extends the ability to perform searches or run applications to scenarios where tapping a keyboard or touching a display are not possible.

Google Assistant exists in many guises such as on smartphones and watches, TVs, PCs, and also on dedicated hardware, such as the voice-only Google Home and Google Home Mini, or with “smart display” screens on the Google Nest Hub or devices from Lenovo and Harman. While assistant devices have been popular, Android phones (which nag you to set up the Assistant) must form the largest subset of users. Over all the device types, the company claims over 500 million active users.

[…]

Actions Builder will “replace DialogFlow as the preferred way to develop actions on the assistant,” said Shodjai.

Google's new Action Builder at work

Google’s new Action Builder at work

Trying out the new Action Builder, we discovered that running an action under development is impossible if you have the Web and App Activity permission, which lets Google keep a record of your actions, disabled. A dialog appears prompting you to enable it. It is a reminder of how Google Assistant is entwined with the notion that you give Google your data in return for personalised experiences.

[…]

“Sometimes you want to build experiences that enable the mic to remain open, to enable users to speak more naturally with your action, without waiting for a change in mic states,” said Shodjai at the summit and in the developer post.

“Today we are announcing an early access program for Continuous Match Mode, which allows the assistant to respond immediately to user’s speech enabling more natural and fluid experiences. This is done transparently, so that before the mic opens the assistant will announce, ‘the mic will stay open temporarily’, so users know they can now speak freely without waiting for additional prompts.”

The mode is not yet publicly documented. The demonstrated example was for a game with jolly cartoon pictures; but there may be privacy implications since in effect this setting lets the action continue to listen to everything while the mode is active.

Shodjai did not explain how users will end a Continuous Match Mode session but presumably this will be either after a developer-defined exit intent, or via a system intent as with existing actions. Until that happens, the action will be able to keep running.

Just as with personalisation via tracking and data collection, privacy and pervasive computing do not sit comfortably together, and with the new Continuous Match Mode a little more privacy slips away.

Source: Google isn’t even trying to not be creepy: ‘Continuous Match Mode’ in Assistant will listen to everything until it’s disabled • The Register

Steris, Medical Device Maker Threatens iFixit Over Ventilator Repair Project, publishing manuals

A popular website with a comprehensive database of repair manuals for ventilators and other medical devices has received a letter from a medical equipment company saying that its copyrights are being infringed.

Kyle Wiens, CEO of the repair website iFixit—which posts guides on how to repair anything from sewing machines to video game consoles—shared the letter on Twitter Thursday, sent to him by counsel for Steris Corporation, which makes sterilization and other medical equipment.

“It has come to my attention that you have been reproducing certain installation and maintenance manuals relating to our products, documentation which is protected by copyright law,” the letter said. The letter then went on to tell Wiens to remove all Steris copyrighted material from the iFixit website within 10 days of the letter.

As Motherboard reported in March, major manufacturers of medical devices have long made it difficult for their devices to be repaired through third party repair professionals. Manufacturers have often lobbied against right to repair legislation and many medical devices are controlled by artificial “software locks” that allow only those with authorization to make modifications.

As reported by VICE News last week, a repair technician contracted to repair ventilators for hospitals preparing for COVID-19 said he has struggled to get repair parts or manuals from manufacturers when he has made requests to them.

“I’m disappointed that Steris is resorting to legal threats to stop hospitals from having access to information about how to maintain critical sterilization equipment during a pandemic,” Wiens told Motherboard in an email.

Wiens said he got the idea to post service manuals for medical equipment on iFixit when he began seeing stories about ventilator shortages in Italy. When he saw how some people were using 3-D printers to create ventilator replacement valves, he said he was inspired to create the database of medical equipment guides as a way to help.

“No manufacturer should be stopping hospitals from repairing their equipment,” Wiens said. “The best way to ensure patient safety is to make sure that equipment is being maintained regularly using the manufacturer’s recommended procedures. The only way to do that is if hospitals have up to date manuals.”

With regards to the letter sent by Steris, Wiens said iFixit has not removed any material from its website.

“We explained to Steris that what we did is a lawful and protected fair use under the U.S. Copyright act,” Wiens said.

“iFixit is protected by Section 512 of the Digital Millennium Copyright Act, which allows online platforms to host content contributed by users provided they comply with the Act’s requirements, which iFixit does,” a letter to Steris from the Electronic Frontier Foundation on behalf of iFixit said.

Source: A Medical Device Maker Threatens iFixit Over Ventilator Repair Project – VICE

Amazon Set to Face Antitrust Charges in European Union

European Union officials are preparing to bring antitrust charges against Amazon for abusing its dominance in internet commerce to box out smaller rivals, according to people with knowledge of the case.

Nearly two years in the making, the case is one of the most aggressive attempts by a government to crimp the power of the e-commerce giant, which has largely sidestepped regulation throughout its 26-year history.

The European Union regulators, who already have a reputation as the world’s most aggressive watchdogs of the technology industry, have determined that Amazon is stifling competition by unfairly using data collected from third-party merchants to boost its own product offerings, said the people, who spoke on the condition of anonymity because the deliberations were private.

The case against Amazon is part of a broader attempt in the United States and Europe to probe the business practices of the world’s largest technology companies, as authorities on both sides of the Atlantic see what they believe is a worrying concentration of power in the digital economy.

Margarethe Vestager, the European Commissioner who leads antitrust enforcement and digital policy, is also examining practices by Apple and Facebook. In Washington, the Justice Department, Federal Trade Commission and Congress are targeting Amazon, Apple, Facebook and Google.

William Kovacic, a law professor at George Washington University, said the tech industry was facing a “striking critical mass” of attention from governments around the world, including Australia, Brazil and India. He said that regulators in Brussels and Washington may deploy so-called interim measures against the companies, a rarely used tool that could force Amazon and other large tech platforms to halt certain practices while a case is litigated.

[…]

The case stems from Amazon’s treatment of third-party merchants who rely on its website to reach customers. Investigators have focused on Amazon’s dual role as both the owner of its online store and a seller of goods that compete with other sellers, creating a conflict of interest.

Authorities in Europe have concluded that Amazon abuses its position to give its own products preferential treatment. European officials have spent the past year interviewing merchants and others who depend on Amazon to better understand how it collects data to use to its advantage, including agreements that require them to share certain data with Amazon as a condition of selling goods on the platform.

Many merchants have complained that if they have a product that is selling well on Amazon, the company will then introduce its own product at a lower price, or give it more prominent placement on the website.

Source: Amazon Set to Face Antitrust Charges in European Union – The New York Times

So yeah, I had a talk about that in 2019

Internet Archive Ends Free Ebook Program Early due to money grubbing copyright enforcers suing them for being a library

Back in March, the Internet Archive launched its National Emergency Library, a program that made roughly 1.4 million books available to the public without the usual waitlists. But on Wednesday, the organization announced it was ending the program two weeks early after four major publishers decided to sue Internet Archive for copyright infringement.

Internet Archive explained in a blog post that after June 16, it would revert to a controlled digital lending model, in which libraries lend patrons digitized copies of a physical book one at a time. “We moved up our schedule because, last Monday, four commercial publishers chose to sue Internet Archive during a global pandemic,” the non-profit said. “However, this lawsuit is not just about the temporary National Emergency Library. The complaint attacks the concept of any library owning and lending digital books, challenging the very idea of what a library is in the digital world.”

By eliminating waitlists, the National Emergency Library program effectively upended how publishers have thus far controlled how libraries distribute ebooks. Under the usual system, publishers sell two-year licenses that cost several times more than what you’d pay if you just bought the book outright. Internet Archive’s program basically made it so any number of people could temporarily download a single ebook an infinite number of times between March 24 and June 30, the original end date for the program.

In their complaint, Hachette, HarperCollins, Penguin Random House, and John Wiley & Sons allege that in addition to violating copyrights, Internet Archive’s free ebook program “grossly exceed legitimate library services” and “constitute willful digital piracy on an industrial scale.”

Before blasting Internet Archive for capitulating, this lawsuit has the ability to tank the organization—probably best known for its Wayback Machine web archiving tool—for good. Publishers could claim up to $150,000 in damages per title. When you multiply that by the 1.4 million works Internet Archive put up for free, the final number could be astronomical, and well beyond the nonprofit’s ability to pay. A win for publishers would put Internet Archive’s other projects at risk.

It appears that publishers aren’t just after Internet Archive’s temporary free ebook initiative. The complaint also contends that controlled digital lending is an “invented theory” and that its rules “have been concocted from whole cloth and continue to get worse.” It also contends that Internet Archive’s “one-to-one conflation of print and ebooks is fundamentally flawed.” Controlled digital lending, however, isn’t unique to Internet Archive. It’s a framework that’s been supported by several libraries over the years, including many university libraries like UC Berkeley Library. Publishers winning this lawsuit may potentially also put the kibosh on the entire controlled digital lending model.

It’s clear that Internet Archive’s decision was intended to appease publishers into dropping the suit. According to Internet Archive, some academic publishers who were initially displeased with the National Emergency Library eventually came around. That said, it’s unclear whether commercial publishers would do the same, as they have everything to gain by strengthening their hold over ebook copyrights.

Source: Internet Archive Ends Free Ebook Program Early

Someone got so fed up with GE fridge DRM – yes, fridge DRM – they made a whole website on how to bypass it

Fed up with the DRM in a General Electric refrigerator that pushed the owner to buy expensive manufacturer-approved replacement water filters, an anonymous hacker went to the trouble of buying a domain name and setting up a website at gefiltergate.com to pen a screed about appliance digital rights restriction management (DRM) and how to bypass it.

The fridge in question required a GE RPWFE refrigerator water filter. It has an RFID chip, which the fridge uses to verify the authenticity of the part. The RPWFE filter costs much more than unapproved filters: about $50 compared to $13.

“Some ******* at GE thought it would be a good idea to include a ******* RFID DRM module in select refrigerators,” the unidentified individual wrote, without using the asterisks we’ve included because online profanity filters are awful.

The Register contacted GE to ask about this, and the American giant’s corporate communications director promptly replied that GE sold its appliance unit to China-based Haier in 2016, which continues to use its brand. Haier did not immediately respond to our inquiry.

The gefiltergate.com website, borrowing from a similar post on another website back in May, explains how to hack your Haier GE-brand fridge by affixing an RFID tag – stripped from a component for bypassing the water filter system – to the RFID sensor.

The GE website suggests that a water filter is a good idea to avoid exposure to unfiltered water and sediment, inadvertently offering a sad commentary on public water infrastructure and government funding priorities. It recommends its RFID water filter because the chip chats with the fridge to report leaks, and will shut off the water supply if a leak is detected.

But the appliance doesn’t require the RFID filter; fridge owners can use the bypass plug, and still get unfiltered water.

“Non-GE filters and counterfeit filters without this technology will not perform the same way in the event of a water leak,” the company’s website explains. “The refrigerator has the option to use a bypass plug should you not want to use a genuine GE Appliances water filter.”

That makes it sound as if fridge owners can use water filters from another vendor but that’s not the case – the bypass plug is just to silence the fridge display screen warnings coming from the filtration system’s RFID sensor. “The ID chip on the filter detects when a wrong or non-genuine GE Appliance part is used,” the GE Appliances website states. “If this happens, the dispenser will not work and the display may read ‘Leak Detected.'”

Hence the need to hack the fridge, which is something product owners evidently have been doing for years. The Amazon.com webpage for the bypass plug contains a string of user reviews indicating that customers only purchased the thing for its RFID chip. And complaints abound on discussion site Reddit.

In a phone interview with The Register, Gay Gordon-Byrne, executive director of The Repair Association, said product hacking of this sort is entirely legal, in America at least. The US Copyright Office, she said, included software-enabled appliance repair in its 2018 rulemaking [PDF], and patents are not an issue in this case. And the Magnuson-Moss Warranty Act guarantees that consumers can use parts not from the original manufacturer.

Asked whether such practices generate enough ill-will to make them unprofitable, Gordon-Byrne said they can, pointing to Keurig’s problems selling coffee makers with digital locks, but added that people have to be aware of the problem.

“It generates some ill will but not enough to offset the value of controlling the whole parts market,” she said. “But it’s a stupid, stupid thing to do. There’s no reason to do this.”

Right-to-repair legislation, which aims to ensure consumers have a legal right to repair products where product makers or laws deny that possibility, was being considered in about 20 US states last year. However, Gordon-Byrne said that progress has stalled due to the coronavirus outbreak. She expects repair bills will have to be reintroduced in January next year.

Current US Copyright Office exemptions, she said, should be renewed for 2021 and she expects to lobby for new exemptions for product categories where repairs that require breaking digital locks are still not allowed, like boats, medical equipment, and game consoles.

Source: Someone got so fed up with GE fridge DRM – yes, fridge DRM – they made a whole website on how to bypass it • The Register

Trump Administration Eliminates Transgender Health Protections

In an utterly heartless move, the Trump administration on Friday eliminated health care protections for transgender people during an ongoing global pandemic that has claimed more lives in the U.S. than in any other country.

It did this by finalizing a rule under Section 1557 of the Affordable Care Act (ACA), which prohibits health programs or activities from discriminating on the basis of race, color, national origin, sex, age, or disability. The Trump administration rule—announced on the fourth anniversary of the Pulse nightclub shooting and in the middle of Pride month—changes the definition of sex discrimination, eliminating protections due to gender identity, and considers the word “sex” to refer to “male or female and as determined by biology.”

[…]

The nondiscrimination provisions were established by the Obama administration in 2016. That year, the Obama administration issued a rule to implement Section 1557 that redefined sex discrimination to include gender identity, which it defined as, “an individual’s internal sense of gender, which may be male, female, neither, or a combination of male and female, and which may be different from an individual’s sex assigned at birth.”

Under the new rule, a transgender person could be refused care for a checkup at a doctor’s office, according to NPR. Other possible scenarios include a transgender man being denied treatment for ovarian cancer, or a hysterectomy not being covered by an insurer. Some experts say that the rule opens the door for medical providers to refuse to test someone for covid-19, the disease caused by the novel coronavirus, simply because they’re transgender.

When it comes to health insurance and health care, transgender people are vulnerable to being treated negatively by their insurance and health care providers. According to the (old broken link: 2015 U.S. Transgender Survey) 2015 US Transgender Survey (new link) carried out by the National Center for Transgender Equality, transgender people have been denied coverage for care related to their gender transition, for routine care because they were transgender, or for transition-related surgery.

The survey found that 23 percent of respondents reported not going to see a doctor when they needed to because of fear of being mistreated as a transgender person. Of those who did go see a healthcare provider, 33 percent reported that they had had at least one negative experience related to being transgender, such as being refused treatment, verbally harassed, or physically or sexually assaulted, among other horrible experiences.

Source: Trump Administration Eliminates Transgender Health Protections

So Trump is following in the illustrious footsteps of Hungary, whos president immediately used the emergency dictatorial powers bestowed upon him due to Covid to changes the “sex” category in official documents like birth certificates to “sex at birth,” which can never be changed.

Source: Hungary bans legal recognition of its transgender citizens

Dutch Justice minister wants to put webhosters that won’t do what he wants on a shaminglist, unburdened by proof and using kiddie porn as an excuse

The stance seems to be: If minister Grapperhaus tells a webhost to remove content, they should do it without the court system intervening.

As soon as they invoke kiddie porn you know that something totalitarian is being justified. Because once that is allowed, then they expand the powers to all content. And noboday can be seen to be against fighting kiddie porn, right?

Source: Foute en lakse webhosters gaan per september op een zwarte lijst – Emerce

Space Force Losing Trademark Battle With Netflix’s Space Force

The real Space Force may be going down in flames against the fictional Space Force: According to the Hollywood Reporter, the newly founded military branch appears to be losing a trademark battle with the Netflix comedy show of the same name.

Netflix “has outmaneuvered the U.S. government to secure trademark rights to ‘Space Force’ in Europe, Australia, Mexico and elsewhere,” according to the Reporter, while the Air Force—under which the Space Force is organized—simply has a pending application stateside. This mostly has ramifications for merch. Consumers won’t have trouble discerning between the military branch and Space Force when it comes to which one stars Steve Carrell, but they might not be able who is selling a line of Space Force shirts.

The U.S. Patent and Trademark Office relies on a “first-to-use” system when assigning rights, and Netflix has been submitting trademark applications for the Space Force across the globe since the start of 2019. On the other hand, the Air Force filed a trademark application on the basis of intent to use in March 2019, per Law & Crime, and the Space Force didn’t become an actual organization until December 2019. If it comes down to a legal battle, that means Netflix may be able to easily demonstrate it was actually using the Space Force branding first. (Even if Netflix lost the case, it would have a First Amendment right to continue selling Space Force merch on the grounds of satire and parody.)

Source: Space Force Losing Trademark Battle With Netflix’s Space Force

OK, so not only is this silly but the fact that you can apparently actually trademark two words in a row seems absolutely bonkers to me.

Zoom won’t encrypt free calls because it wants to comply with law enforcement

If you’re a free Zoom user, and waiting for the company to roll out end-to-end encryption for better protection of your calls, you’re out of luck. Free calls won’t be encrypted, and law enforcement will be able to access your information in case of ‘misuse’ of the platform.

Zoom CEO Eric Yuan today said that the video conferencing app’s upcoming end-to-end encryption feature will be available to only paid users. After announcing the company’s financial results for Q1 2020, Yuan said the firm wants to keep this feature away from free users to work with law enforcement in case of the app’s misuse:

Free users, for sure, we don’t want to give that [end-to-end encryption]. Because we also want to work it together with FBI and local law enforcement, in case some people use Zoom for bad purpose.

In the past, platforms with end-to-end encryption, such as WhatsApp, have faced heavy scrutiny in many countries because they were unable to trace the origins of problematic and misleading messages. Zoom likey wants to avoid being in such a position, and wants to comply with local laws to keep operating across the globe.

Alex Stamos, working as a security consultant with Zoom, said it wants to catch repeat offenders for hate speech or child exploitative content by not offering end-to-end encryption t0 free users.

In March, The Intercept published a report stating that the company doesn’t use end-to-end encryption, despite claiming that on its website and security white paper. Later, Zoom apologized and issued a clarification to specify it didn’t provide the feature at that time.

Last month, the company acquired Keybase.io, an encryption-based identity service, to build its end-to-end encryption offering. Yuan said today that the company got a lot of feedback from users on encryption, and it’s working out on executing it. However, he didn’t specify a release date for the feature.

According to the Q1 2020 results, the company grew 169% year-on-year in terms of revenue. Zoom has more than 300 million daily participants attending meetings through the platform.

Source: Zoom won’t encrypt free calls because it wants to comply with law enforcement

GSMA suggests mobile carriers bake contact-tracing into their own apps – if governments ask for it

The GSM Association, the body that represents mobile carriers and influences the development of standards, has suggested its members bake virus contact-tracing functionality into their own bundled software.

The body today popped out a paper [PDF] on contact-tracing apps. After some unremarkable observations about the need for and operations of such apps, plus an explanation of the centralised vs. centralised data storage debate, the paper offers members a section titled: “How the mobile industry can help.”

That section suggests carriers could help to improve the reach of and disseminate such apps with the following three tactics:

  • Integrate software into own apps (e.g. customer self-care app), if this is part of the national strategy
  • Pre-install on devices
  • Communicate to / educate subscribers

The first item may prove unworkable given Google and Apple have indicated they’ll only register coronavirus-related apps if they’re developed by governments and their health agencies. The two tech giants have also said they’ll only allow one app per jurisdiction to use their pro-privacy COVID-19 contact-tracing interface. The second suggestion also has potential pitfalls as contact-tracing apps are generally opt-in affairs. Carriers would need to be sensitive about how they are installed and the user experience offered if the apps ask for registration.

Source: GSMA suggests mobile carriers bake contact-tracing into their own apps – if governments ask for it • The Register

Did Instagram Just Say It’s Rewriting Online Copyright? Use their embedded API at your peril

In one fell swoop, Facebook may have changed its mind about how the online news media will operate from here on out. Undermining a now age-old assumption, Facebook told Ars Technica on Thursday that embedding from Instagram may not shield news organizations from freely cross-posting on their sites. A spokesperson said:

While our terms allow us to grant a sub-license, we do not grant one for our embeds API. Our platform policies require third parties to have the necessary rights from applicable rights holders.

The dry statement could mean upheaval for online publishing, implying that a news organization (or anyone running a for-profit site) would have to obtain a license for an Instagram post directly from the poster before they can embed it. Some will worry that it bodes a future in which publications retroactively strike every Instagram embed from its archives in order to avoid lawsuits.

On one hand, it’s good news for professional photographers and artists who would otherwise be paid for the use of their work embedded on a personal website. Photographers like the ones who separately sued Mashable and Newsweek for embedding their Instagram posts, both after they explicitly declined to license the images to the respective publications. On the other hand, this might be the last gasp for Instagram commentary, the bread of the news, the spice of the tea blogs.

Source: Did Instagram Just Say It’s Rewriting Online Copyright?

Publishers bizarrely File Suit Against Internet Archive for Systematic Mass Scanning and Distribution of Literary Works

Today, member companies [Note only four members – ed] of the Association of American Publishers (AAP) filed a copyright infringement lawsuit against Internet Archive (“IA”) in the United States District Court for the Southern District of New York. The suit asks the Court to enjoin IA’s mass scanning, public display, and distribution of entire literary works, which it offers to the public at large through global-facing businesses coined “Open Library” and “National Emergency Library,” accessible at both openlibrary.org and archive.org. IA has brazenly reproduced some 1.3 million bootleg scans of print books, including recent works, commercial fiction and non-fiction, thrillers, and children’s books.

The plaintiffs—Hachette Book Group, HarperCollins Publishers, John Wiley & Sons and Penguin Random House—publish many of the world’s preeminent authors, including winners of the Pulitzer Prize, National Book Award, Newbery Medal, Man Booker Prize, Caldecott Medal and Nobel Prize.

Despite the self-serving library branding of its operations, IA’s conduct bears little resemblance to the trusted role that thousands of American libraries play within their communities and as participants in the lawful copyright marketplace. IA scans books from cover to cover, posts complete digital files to its website, and solicits users to access them for free by signing up for Internet Archive Accounts. The sheer scale of IA’s infringement described in the complaint—and its stated objective to enlarge its illegal trove with abandon—appear to make it one of the largest known book pirate sites in the world. IA publicly reports millions of dollars in revenue each year, including financial schemes that support its infringement design.

Source: Publishers File Suit Against Internet Archive for Systematic Mass Scanning and Distribution of Literary Works – AAP

This is book publishers filing against a library. Copyright has gone nuts.

The lawsuit was filed in Federal court in New York City by Penguin Random House, Hachette Book Group, John Wiley & Sons, and HarperCollins Publishers.

The complaint notes that these four publishers are all members of the Association of American Publishers (AAP). AAP was one of 40 signatories, including the NWU, of a joint Appeal from the Victims of Controlled Digital Lending issued in 2019. Two of the four publishers bringing the lawsuit are US subsidiaries of European parent companies (Hachette Livre, which is part of the Lagardère Publishing group, and Bertelsmann) that are affiliated with the Federation of European Publishers (FEP), which also co-signed the Appeal.

The court complaint, however, was brought only by the four named publishers, and not as a class action. At least as originally filed, neither AAP, FEP, nor any authors or organizations of authors are parties to the lawsuit. The NWU had no advance knowledge whatsoever regarding this lawsuit.

Source: Publishers Sue the Internet Archive for Scanning Books (National Writers Union)

Obviously though a large group of self serving copyright vampires is congratulating the serving monkeys for killing off culture in favor of money in their collective pockets.

Qatar’s contact tracing app put over one million people’s info at risk

Contact tracing apps have the potential to slow the spread of COVID-19. But without proper security safeguards, some fear they could put users’ data and sensitive info at risk. Until now, that threat has been theoretical. Today, Amnesty International reports that a flaw in Qatar’s contact tracing app put the personal information of more than one million people at risk.

The flaw, now fixed, made info like names, national IDs, health status and location data vulnerable to cyberattacks. Amnesty’s Security Lab discovered the flaw on May 21st and says authorities fixed it on May 22nd. The vulnerability had to do with QR codes that included sensitive info. The update stripped some of that data from the QR codes and added a new layer of authentication to prevent foul play.

Qatar’s app, called EHTERAZ, uses GPS and Bluetooth to track COVID-19 cases, and last week, authorities made it mandatory. According to Amnesty, people who don’t use the app could face up to three years in prison and a fine of QR 200,000 (about $55,000).

“This incident should act as a warning to governments around the world rushing out contact tracing apps that are too often poorly designed and lack privacy safeguards. If technology is to play an effective role in tackling the virus, people need to have confidence that contact tracing apps will protect their privacy and other human rights,” said Claudio Guarnieri, head of Amnesty International’s Security Lab.

Source: Qatar’s contact tracing app put over one million people’s info at risk | Engadget

Libraries Have Never Needed Permission To Lend Books, And The Move To Change That Is A Big Problem

There are a variety of opinions concerning the Internet Archive’s National Emergency Library in response to the pandemic. I’ve made it clear in multiple posts why I believe the freakout from some publishers and authors is misguided, and that the details of the program are very different than those crying about it have led you to believe. If you don’t trust my analysis and want to whine about how I’m biased, I’d at least suggest reading a fairly balanced review of the issues by the Congressional Research Service.

However, Kyle Courtney, the Copyright Advisor for Harvard University, has a truly masterful post highlighting not just why the NEL makes sense, but just how problematic it is that many — including the US Copyright Office — seem to want to move to a world of permission and licensing for culture that has never required such things in the past.

Licensing culture is out of control. This has never been clearer than during this time when hundreds of millions of books and media that were purchased by libraries, archives, and other cultural intuitions have become inaccessible due to COVID-19 closures or, worse, are closed off further by restrictive licensing.

What’s really set Courtney off is that the Copyright Office has come out, in response to the NEL, to suggest that the solution to any such concerns raised by books being locked up by the pandemic must be more licensing:

The ultimate example of this licensing culture gone wild is captured in a recent U.S. Copyright Office letter. Note that this letter is not a legally binding document. It is the opinion of an office under the control of the Library of Congress, that is tasked among other missions, with advising Congress when they ask copyright questions, as in this case.

Senator Tom Udall asked the Copyright Office to give its legal analysis of the NEL and similar library efforts, and it did so… badly.

The Office responded with a letter revealing their recommendation was not going to be the guidance document to “help libraries, authors, and online outlets,” but, ultimately, called for more licensing. It also continued a common misunderstanding of an important case, Capitol Records, LLC v. ReDigi Inc., 910 F. 3d 649 (2d Cir 2018).

We’ve written about the Redigi case a few times, but as Courtney details, the anti-internet, pro-extreme copyright folks have embraced it to mean much more than it actually means (we’ll get back that shortly). Courtney points out that the Copyright Office seems to view everything through a single lens: “licensing” (i.e., permission). So while the letter applauds more licensing, that’s really just a celebration of greater permission when none is necessary. And through that lens the Copyright Office seems to think that the NEL isn’t really necessary because publishers have been choosing to make some of their books more widely available (via still restrictive licensing). But, as Courtney explains, libraries aren’t supposed to need permission:

Here’s the problem though: these vendors and publishers are not libraries. The law does not treat them the same. Vendors must must ask permission, they must license, this is their business model. Libraries are special creatures of copyright. Libraries have a legally authorized mandate granted by Congress to complete their mission to provide access to materials. They put many of these in copyright exemptions for libraries in the Copyright Act itself.

The Copyright Office missed this critical difference completely when it said digital, temporary, or emergency libraries should “seek permission from authors or publishers prior” to the use. I think think this is flat-out wrong. And I have heard this in multiple settings over the last few months: somehow it has crept into our dialog that libraries should have always sought a license to lend books, even digital books, exactly like the vendors and publishers who sought permission first. Again, this is fundamentally wrong.

Let me make this clear: Libraries do not need a license to loan books. What libraries do (give access to their acquired collections of acquired books) is not illegal. And libraries generally do not need to license or contract before sharing these legally acquired works, digital or not. Additionally, libraries, and their users, can make (and do make) many uses of these works under the law including interlibrary loan, reserves, preservation, fair use, and more!

[…]

Source: Libraries Have Never Needed Permission To Lend Books, And The Move To Change That Is A Big Problem | Techdirt

Hey Siri, are you still recording people’s conversations despite promising not to do so nine months ago?

Apple may still be recording and transcribing conversations captured by Siri on its phones, despite promising to put an end to the practice nine months ago, claims a former Apple contractor who was hired to listen into customer conversations.

In a letter [PDF] sent to data protection authorities in Europe, Thomas Le Bonniec expresses his frustration that, despite exposing in April 2019 that Apple has hired hundreds of people to analyze recordings that its users were unaware had been made, nothing appears to have changed.

Those recordings were captured by Apple’s Siri digital assistant, which constantly listens out for potential voice commands to obey. The audio was passed to human workers to transcribe, label, and analyze to improve Siri’s neural networks that process what people say. Any time Siri heard something it couldn’t understand – be it a command or someone’s private conversation or an intimate moment – it would send a copy of the audio to the mothership for processing so that it could be retrained to do better next time.

Le Bonniec worked for Apple subcontractor Globe Technical Services in Ireland for two months, performing this manual analysis of audio recorded by Siri, and witnessed what he says was a “massive violation of the privacy of millions of citizens.”

“All over the world, people had their private life recorded by Apple up to the most intimate and sensitive details,” he explained. “Enormous amounts of personal data were collected, stored and analyzed by Apple in an opaque way. These practices are clearly at odds with the company’s privacy-driven policies and should be urgently investigated by Data Protection Authorities and Privacy watchdogs.”

But despite the fact that Apple acknowledged it was in fact transcribing and tagging huge numbers of conversations that users were unaware had been recorded by their Macs and iOS devices, promised a “thorough review of our practices and policies,” and apologized that it hadn’t “been fully living up to our high ideals,” Le Bonniec says nothing has changed.

“Nothing has been done to verify if Apple actually stopped the programme. Some sources already confirmed to me that Apple has not,” he said.

“I believe that Apple’s statements merely aim to reassure their users and public authorities, and they do not care for their user’s consent, unless being forced to obtain it by law,” says the letter. “It is worrying that Apple (and undoubtedly not just Apple) keeps ignoring and violating fundamental rights and continues their massive collection of data.”

In effect, he argues, “big tech companies are basically wiretapping entire populations despite European citizens being told the EU has one of the strongest data protection laws in the world. Passing a law is not good enough: it needs to be enforced upon privacy offenders.”

Not good

How bad is the situation? According to Le Bonniec: “I listened to hundreds of recordings every day, from various Apple devices (e.g. iPhones, Apple Watches, or iPads). These recordings were often taken outside of any activation of Siri, e.g. in the context of an actual intention from the user to activate it for a request.

“These processings were made without users being aware of it, and were gathered into datasets to correct the transcription of the recording made by the device. The recordings were not limited to the users of Apple devices, but also involved relatives, children, friends, colleagues, and whoever could be recorded by the device.

“The system recorded everything: names, addresses, messages, searches, arguments, background noises, films, and conversations. I heard people talking about their cancer, referring to dead relatives, religion, sexuality, pornography, politics, school, relationships, or drugs with no intention to activate Siri whatsoever.”

So, pretty bad.

Source: Hey Siri, are you still recording people’s conversations despite promising not to do so nine months ago? • The Register

Copyright Making Sure That MTV Remains An Irrelevant Relic, Rather Than A Cultural Icon

For those of us of a certain age, MTV defined culture. It was where we learned about not just music, but wider pop culture. Of course, MTV lost its cultural place atop the mountaintop with the rise of the internet, but that doesn’t mean that it wasn’t a key source of culture in the 1980s. Historically, the way that society preserves and remembers culture is to share it and spread it around. This is actually how culture is created. Yet copyright is the opposite of that. Copyright is about locking up content and denying the ability to create shared culture around it. And the best evidence of this is the fact that someone (it is not entirely clear who…) with the power to do so, demanded that the Internet Archive take down a bunch of old MTV videos that were uploaded.

From a purely legal standpoint, it seems quite likely that whoever issued the takedown did have a legal leg to stand on. The real question, however, should be whether or not they have a moral or cultural leg to stand on. After all, if the entire point of copyright — as per the Constitution — is to encourage “the progress” then how does taking these old clips down do anything to support that goal?

There are a number of other points worth mentioning to demonstrate how crazy this whole thing is, starting with the fact that MTV itself knew how important it was to build on cultural touchstones in that its whole logo/image was built off a public domain image from just a few years earlier. The moon landing was in 1969, and MTV launched in 1981. Imagine if this image had been locked up under copyright?

This also demonstrates a separate point we’ve been making for years, which is that the actual commercial value of a piece of work locked up behind copyright, tends not to be that long, and yet we locked it up for basically a century for no good reason at all. In the earliest copyright times in the US, copyright initially was for 14 years, which could be renewed for another 14 if the copyright holder felt it was worth it. A maximum of 28 years would mean that most of the uploaded clips would now be in the public domain if we had kept those terms. And, as we’ve pointed out repeatedly, back when copyright was 28 years, renewable for another 28 years, very few works were renewed, suggesting that the vast majority of copyright holders did not see any reason to retain their copyright beyond 28 years (indeed, the numbers suggest many would have been fine with significantly shorter copyright terms):

Yet, today copyright automatically lasts beyond most of our lifetimes. And, for what purpose? Right now, MTV is not particularly culturally relevant. You’d think that someone might jump at the chance to get renewed interest in MTV’s past cultural relevance, but the belief that copyright means we must lock up culture seems to prevail over common sense.

Taking down these cultural touchstones may have been perfectly legal, but all it’s really done is help demonstrate the many, many problems of today’s copyright law and how it destroys, rather than enhances, culture.

Source: Copyright Making Sure That MTV Remains An Irrelevant Relic, Rather Than A Cultural Icon | Techdirt

The Internet Furry Drama Raising Big Questions About Artificial Intelligence and Copyright

Much of the fun of internet drama comes from its frivolousness, but sometimes an online shitfest points to something bigger. Last week, the AI-powered furry art site thisfursonadoesnotexist did just that, igniting a fandom firestorm while also highlighting an important debate about digital art. Trained on more than 55,000 images pulled (without permission) from a furry art forum, the algorithm was a simple case of art theft to some. For others, it was a chance to break out the popcorn. But legal scholars who spoke with Gizmodo said the conflict raises thorny questions about ownership in the age of AI—questions that may ultimately have to be answered in court.

Arfa, the programmer behind thisfursonadoesnotexist, says he used the same GAN (generative adversarial network) architecture behind the site thispersondoesnotexist to generate around 186,000 furry portraits. When he posted the project on Twitter last Wednesday, dozens of commenters rushed to weigh in. While many were fascinated by the project, some in the furry community objected to Arfa’s unauthorized use of art from the furry forum e621.net as training data. At least one person tried (and failed) to find proof that the algorithm was copying images from e621.net outright. And within days, the entire site was slapped with a DMCA copyright infringement complaint. (The company whose name the DMCA was issued in, according to Arfa, denied filing the notice and requested it be withdrawn.)

[…]

The creator of thisfursonadoesnotexist thinks it would’ve been impossible to contact all the artists involved. Arfa told Gizmodo that he scraped 200,000 images that were then narrowed down to a 55,000-image training set representing approximately 10,000 different artists—creators who may go by different names now or have left the fandom entirely. According to Arfa, he’s more than willing to take an image down from thisfursonadoesnotexist if it clearly copies an original character, but he says he has yet to see credible evidence of that.

In defense of the AI’s originality, the site has produced a collection of mushier fursonas whose delirious weirdness inspired a flurry of memes. “Some of these have designs that are so… specific? Holistic?” a commenter on Hacker News wrote, linking to a fursona with a tail sticking out of her head and an adorably half-formed feline mouse. Do these Cronenberg-esque misfit furries, with their wild-eyed gazes, scream “LOVE ME”or “SAVE ME”? The art world adores liminality—that’s value added right there.

Illustration for article titled The Internet Furry Drama Raising Big Questions About Artificial Intelligence
Image: Thisfursonadoesnotexist

Furry artists aren’t alone in facing the dilemma of digital manipulation. Just last month, Jay Z filed DMCA takedown notices against a YouTuber who used speech synthesis software to make his voice read the Book of Genesis and cover Billy Joel’s “We Didn’t Start the Fire.” While experts explained to Gizmodo that Jay Z’s issue isn’t copyright, since copyright doesn’t cover speech patterns, both incidents suggest a future where machine learning art is widespread, even commonplace. In such a future, can an artist’s original work be used as training material? If so, to what end? (In Jay Z’s case, YouTube ultimately allowed the videos to stand.)

Source: The Internet Furry Drama Raising Big Questions About Artificial Intelligence