AI

AI Companies Would Be Required To Disclose Copyrighted Training Data Under New Bill (theverge.com) 42

An anonymous reader quotes a report from The Verge: Two lawmakers filed a bill requiring creators of foundation models to disclose sources of training data so copyright holders know their information was taken. The AI Foundation Model Transparency Act -- filed by Reps. Anna Eshoo (D-CA) and Don Beyer (D-VA) -- would direct the Federal Trade Commission (FTC) to work with the National Institute of Standards and Technology (NIST) to establish rules for reporting training data transparency. Companies that make foundation models will be required to report sources of training data and how the data is retained during the inference process, describe the limitations or risks of the model, how the model aligns with NIST's planned AI Risk Management Framework and any other federal standards might be established, and provide information on the computational power used to train and run the model. The bill also says AI developers must report efforts to "red team" the model to prevent it from providing "inaccurate or harmful information" around medical or health-related questions, biological synthesis, cybersecurity, elections, policing, financial loan decisions, education, employment decisions, public services, and vulnerable populations such as children.

The bill calls out the importance of training data transparency around copyright as several lawsuits have come out against AI companies alleging copyright infringement. It specifically mentions the case of artists against Stability AI, Midjourney, and Deviant Art, (which was largely dismissed in October, according to VentureBeat), and Getty Images' complaint against Stability AI. The bill still needs to be assigned to a committee and discussed, and it's unclear if that will happen before the busy election campaign season starts. Eshoo and Beyer's bill complements the Biden administration's AI executive order, which helps establish reporting standards for AI models. The executive order, however, is not law, so if the AI Foundation Model Transparency Act passes, it will make transparency requirements for training data a federal rule.

Lord of the Rings

Tolkien Estate Wins Court Order To Destroy Fan's 'Lord of the Rings' Sequel (nytimes.com) 136

Remy Tumin reports via the New York Times: It was supposed to be what a fan described as a "loving homage" to his hero, the author J.R.R. Tolkien, and to "The Lord of the Rings," which he called "one of the most defining experiences of his life." A judge in California had another view. The fan, Demetrious Polychron of Santa Monica, Calif., violated copyright protections this year when he wrote and published a sequel to the epic "Rings" series, U.S. District Judge Stephen V. Wilson of the Central District of California ruled last week. In a summary judgment, Judge Wilson found "direct evidence of copying" and barred Polychron from further distributing the book or any others in a planned series. He also ordered Polychron to destroy all electronic and physical copies of the published work, "The Fellowship of the King," by Sunday. As of Wednesday, Amazon and Barnes & Noble were no longer listing the book for sale online. Steven Maier, a lawyer for the Tolkien estate, said the injunction was "an important success" for protecting Tolkien's work. "This case involved a serious infringement of The Lord of the Rings copyright, undertaken on a commercial basis," he said. "The estate hopes that the award of a permanent injunction and attorneys' fees will be sufficient to dissuade others who may have similar intentions."
Crime

Teen GTA VI Hacker Sentenced To Indefinite Hospital Order (theverge.com) 77

Emma Roth reports via The Verge: The 18-year-old Lapsus$ hacker who played a critical role in leaking Grand Theft Auto VI footage has been sentenced to life inside a hospital prison, according to a report from the BBC. A British judge ruled on Thursday that Arion Kurtaj is a high risk to the public because he still wants to commit cybercrimes.

In August, a London jury found that Kurtaj carried out cyberattacks against GTA VI developer Rockstar Games and other companies, including Uber and Nvidia. However, since Kurtaj has autism and was deemed unfit to stand trial, the jury was asked to determine whether he committed the acts in question, not whether he did so with criminal intent. During Thursday's hearing, the court heard Kurtaj "had been violent while in custody with dozens of reports of injury or property damage," the BBC reports. A mental health assessment also found that Kurtaj "continued to express the intent to return to cybercrime as soon as possible." He's required to stay in the hospital prison for life unless doctors determine that he's no longer a danger.

Kurtaj leaked 90 videos of GTA VI gameplay footage last September while out on bail for hacking Nvidia and British telecom provider BT / EE. Although he stayed at a hotel under police protection during this time, Kurtaj still managed to carry out an attack on Rockstar Games by using the room's included Amazon Fire Stick and a "newly purchased smart phone, keyboard and mouse," according to a separate BBC report. Kurtaj was arrested for the final time following the incident. Another 17-year-old involved with Lapsus$ was handed an 18-month community sentence, called a Youth Rehabilitation Order, and a ban from using virtual private networks.

AI

Rite Aid Banned From Using Facial Recognition Software 60

An anonymous reader quotes a report from TechCrunch: Rite Aid has been banned from using facial recognition software for five years, after the Federal Trade Commission (FTC) found that the U.S. drugstore giant's "reckless use of facial surveillance systems" left customers humiliated and put their "sensitive information at risk." The FTC's Order (PDF), which is subject to approval from the U.S. Bankruptcy Court after Rite Aid filed for Chapter 11 bankruptcy protection in October, also instructs Rite Aid to delete any images it collected as part of its facial recognition system rollout, as well as any products that were built from those images. The company must also implement a robust data security program to safeguard any personal data it collects.

A Reuters report from 2020 detailed how the drugstore chain had secretly introduced facial recognition systems across some 200 U.S. stores over an eight-year period starting in 2012, with "largely lower-income, non-white neighborhoods" serving as the technology testbed. With the FTC's increasing focus on the misuse of biometric surveillance, Rite Aid fell firmly in the government agency's crosshairs. Among its allegations are that Rite Aid -- in partnership with two contracted companies -- created a "watchlist database" containing images of customers that the company said had engaged in criminal activity at one of its stores. These images, which were often poor quality, were captured from CCTV or employees' mobile phone cameras.

When a customer entered a store who supposedly matched an existing image on its database, employees would receive an automatic alert instructing them to take action -- and the majority of the time this instruction was to "approach and identify," meaning verifying the customer's identity and asking them to leave. Often, these "matches" were false positives that led to employees incorrectly accusing customers of wrongdoing, creating "embarrassment, harassment, and other harm," according to the FTC. "Employees, acting on false positive alerts, followed consumers around its stores, searched them, ordered them to leave, called the police to confront or remove consumers, and publicly accused them, sometimes in front of friends or family, of shoplifting or other wrongdoing," the complaint reads. Additionally, the FTC said that Rite Aid failed to inform customers that facial recognition technology was in use, while also instructing employees to specifically not reveal this information to customers.
In a press release, Rite Aid said that it was "pleased to reach an agreement with the FTC," but that it disagreed with the crux of the allegations.

"The allegations relate to a facial recognition technology pilot program the Company deployed in a limited number of stores," Rite Aid said in its statement. "Rite Aid stopped using the technology in this small group of stores more than three years ago, before the FTC's investigation regarding the Company's use of the technology began."
AI

AI Cannot Be Patent 'Inventor,' UK Supreme Court Rules in Landmark Case (reuters.com) 29

A U.S. computer scientist on Wednesday lost his bid to register patents over inventions created by his artificial intelligence system in a landmark case in Britain about whether AI can own patent rights. From a report: Stephen Thaler wanted to be granted two patents in the UK for inventions he says were devised by his "creativity machine" called DABUS. His attempt to register the patents was refused by Britain's Intellectual Property Office on the grounds that the inventor must be a human or a company, rather than a machine. Thaler appealed to the UK's Supreme Court, which on Wednesday unanimously rejected his appeal as under UK patent law "an inventor must be a natural person."

"This appeal is not concerned with the broader question whether technical advances generated by machines acting autonomously and powered by AI should be patentable," Judge David Kitchin said in the court's written ruling. "Nor is it concerned with the question whether the meaning of the term 'inventor' ought to be expanded ... to include machines powered by AI which generate new and non-obvious products and processes which may be thought to offer benefits over products and processes which are already known." Thaler's lawyers said in a statement that "the judgment establishes that UK patent law is currently wholly unsuitable for protecting inventions generated autonomously by AI machines."

Bitcoin

Binance To Pay $2.7 Billion Fine To CFTC For Evading Federal Law (cointelegraph.com) 19

Binance will pay $2.7 billion to the Commodity Futures Trading Commission (CFTC) for evading federal law and operating an illegal derivatives exchange. Meanwhile, the cryptocurrency exchange's founder, Changpeng "CZ" Zhao, will pay $150 million.

"The court finds Zhao and Binance violated the Commodity Exchange Act (CEA) and CFTC regulations, imposes a $150 million civil monetary penalty personally against Zhao, and requires Binance to disgorge $1.35 billion of ill-gotten transaction fees and pay a $1.35 billion penalty to the CFTC," wrote the CFTC in a statement. CoinTelegraph reports: The approved settlement marks the conclusion of a long-running case against CZ and Binance by the CFTC. On Nov. 21, CZ agreed to step down from his role at the helm of Binance as part of a wider settlement with the U.S. Department of Justice, the Treasury Department and the CFTC. On the same day, Zhao pleaded guilty to several civil charges and one criminal charge relating to Anti-Money Laundering laws. On Dec. 7, CZ was ordered to remain in the U.S. until his Feb. 23, 2024 sentencing date. He faces up to 18 months in prison on money laundering charges and has agreed not to appeal any potential sentence up to that length.

As part of the settlement, both CZ and Binance have agreed to take further steps to ensure Know Your Customer measures are maintained on the exchange as well as requiring Binance to implement a formalized corporate governance structure, including a board of directors with independent members, a compliance committee and an audit committee. The court also made a separate order for Binance's former chief compliance officer, Samuel Lim, to pay a $1.5 million civil monetary penalty for "aiding and abetting Binance's violations and engaging in activities outside of the U. S. to willfully evade or attempt to evade U.S. law."

Google

Alphabet, States Reach $700 Million Deal in Google Play Feud 20

Alphabet will pay $700 million and alter its Google Play policies to settle claims that the app store unlawfully dominates the Android mobile applications market, resolving antitrust complaints brought by attorneys general of about three dozen states and consumers. From a report: The deal disclosed in a court filing late Monday calls for tweaks to Google Play policies designed to reduce barriers to competition in the markets for app distribution and payment processing. The lawsuits that were grouped together in federal court in California had threatened billions of dollars in revenue generated by the sale and distribution of apps through Google Play. Google will also make a series of changes to its business practices as part of the settlement. In a blog post, the Android-maker said: Streamlining sideloading while prioritizing security: Unlike on iOS, Android users have the option to sideload apps, meaning they can download directly from a developer's website without going through an app store like Google Play. While we maintain it is critical to our safety efforts to inform users that sideloading on mobile could come with unique risks, as part of our settlement we will be further simplifying the sideloading process and updating the language that informs users about these potential risks of downloading apps directly from the web for the first time.
Expanding user choice billing to more people: App and game developers will be able to implement an alternative billing option alongside Google Play's billing system for their U.S. users who can then choose which option to use when making in-app purchases. We have been piloting user choice billing in the U.S. for over a year and will now expand this option further.
Expanding open communication on pricing: We have always given developers more ways to interact with their customers than iOS and other operating systems. For example, Google Play allows developers to communicate freely with their customers outside the app about subscription offers or lower-cost options available on a rival app store or the developer's website. This openness has spurred competition and benefited consumers and developers. As part of user choice billing, which we're expanding with today's settlement announcement, developers are also able to show different pricing options within the app when a user makes a digital purchase.
Books

Internet Archive: Digital Lending Is Fair Use, Not Copyright Infringement 50

Ernesto Van der Sar reports via TorrentFreak: Internet Archive has filed its opening brief in its appeal of a court ruling which found its digital lending program copyright-infringing. The Archive believes the decision should be reversed on the grounds that its lending activities amount to fair use. Founder Brewster Kahle believes the legal battle is vital for the future of all libraries in the United States and around the world. [ "This lawsuit is about more than the Internet Archive; it is about the role of all libraries in our digital age," says IA founder Brewster Kahle. "This lawsuit is an attack on a well-established practice used by hundreds of libraries to provide public access to their collections. The disastrous lower court decision in this case holds implications far beyond our organization, shaping the future of all libraries in the United States and unfortunately, around the world."]

Whether IA has a fair use defense depends on how the four relevant factors are weighed. According to the lower court, these favor the publishers but the library vehemently disagrees. On the contrary, it believes that its service promotes the creation and sharing of knowledge, which is a core purpose of copyright. "This Court should reverse and hold that IA's controlled digital lending is fair use. This practice, like traditional library lending, furthers copyright's goal of promoting public availability of knowledge without harming authors or publishers," the brief reads. A fair use analysis has to weigh the interests of both sides. The lower court did so, but IA argues that it reached the wrong conclusions, failing to properly account for the "tremendous public benefits" controlled digital lending offers.

One of the key fair use factors at stake is whether IA's lending program affects (i.e., threatens) the traditional ebook lending market. IA uses expert witnesses to argue that there's no financial harm and further argues that its service is substantially different from the ebook licensing market. IA offers access to digital copies of books, which is similar to licensed libraries. However, the non-profit organization argues that its lending program is not a substitute as it offers a fundamentally different service. "For example, libraries cannot use ebook licenses to build permanent collections. But they can use licensing to easily change the selection of ebooks they offer to adapt to changing interests," IA writes.

The licensing models make these libraries more flexible. However, they have to rely on the books offered by commercial aggregators and can't add these digital copies to their archives. "Controlled digital lending, by contrast, allows libraries to lend only books from their own permanent collections. They can preserve and lend older editions, maintaining an accurate historical record of books as they were printed. "They can also provide access that does not depend on what Publishers choose to make available. But libraries must own a copy of each book they lend, so they cannot easily swap one book for another when interest or trends change," IA adds.
A copy of the Internet Archive's opening brief, filed at the Second Circuit Court of Appeals, is available here (pdf)
Crime

Nikola Founder Trevor Milton Sentenced To 4 Years For Securities Fraud (techcrunch.com) 34

An anonymous reader quotes a report from TechCrunch: Trevor Milton, the disgraced founder and former CEO of electric truck startup Nikola, was sentenced Monday to four years in prison for securities fraud. The sentence, by Judge Edgardo Ramos in the U.S. District Court in Manhattan, caps a multi-year saga that at one point sent Nikola stock soaring 83% only to come crashing down months later over accusations of fraud and canceled contracts. The sentencing hearing comes after four separate delays, during which Milton has remained free under a $100 million bond.

In his ruling, Ramos said he would impose a sentence of 48 months on each count, served concurrently, and a fine of $1 million. Milton is expected to appeal the sentence, which Ramos acknowledged. Milton sobbed as he pled with Judge Ramos for leniency in a long and often confusing statement ahead of the sentencing. At one point, Milton said he stepped down from the CEO post at Nikola not because of fraud allegations, but to support his wife. "I stepped down because my wife was suffering live threatening sickness," he said in his statement, which reporter Matthew Russell Lee of Inner City Press shared on social media post X. She suffered medical malpractice, someone else's plasma. So I stepped down for that -- not because I was a fraud. The truth matters. I chose my wife over money or power."

During the sentencing hearing, defense attorneys said that Milton wasn't trying to defraud investors or intending to harm anyone. Instead, they argued he simply wanted to be loved and praised like Elon Musk. Prosecutors pushed back and said he lied repeatedly and targeted retail investors. Federal prosecutors recommended an 11-year sentence, but Milton faced a maximum term of 60 years in prison. The government also sought a $5 million fine, forfeiture of a ranch in Utah and an undetermined amount of restitution to investors. Restitution will be determined after Monday's sentencing hearing.
Timeline of events:

June, 2016: Nikola Motor Receives Over 7,000 Preorders Worth Over $2.3 Billion For Its Electric Truck
December, 2016: Nikola Motor Company Reveals Hydrogen Fuel Cell Truck With Range of 1,200 Miles
February, 2020: Nikola Motors Unveils Hybrid Fuel-Cell Concept Truck With 600-Mile Range
June, 2020: Nikola Founder Exaggerated the Capability of His Debut Truck
September, 2020: Nikola Motors Accused of Massive Fraud, Ocean of Lies
September, 2020: Nikola Admits Prototype Was Rolling Downhill In Promo Video
September, 2020: Nikola Founder Trevor Milton Steps Down as Chairman in Battle With Short Seller
October, 2020: Nikola Stock Falls 14 Percent After CEO Downplays Badger Truck Plans
November, 2020: Nikola Stock Plunges As Company Cancels Badger Pickup Truck
July, 2021: Nikola Founder Trevor Milton Indicted on Three Counts of Fraud
December, 2021: EV Startup Nikola Agrees To $125 Million Settlement
September, 2022: Nikola Founder Lied To Investors About Tech, Prosecutor Says in Fraud Trial
Patents

Apple To Pause Selling New Versions of Its Watch After Losing Patent Dispute (nytimes.com) 36

An anonymous reader quotes a report from the New York Times: Apple said on Monday that it would pause sales of its flagship smartwatches online starting Thursday and at retail locations on Christmas Eve. Two months ago, Apple lost a patent case over the technology its smartwatches use to detect people's pulse rate. The company was ordered to stop selling the Apple Watch Series 9 and Watch Ultra 2 after Christmas, which could set off a run on sales of the watches in the final week of holiday shopping. The move by Apple follows a ruling by the International Trade Commission in October that found several Apple Watches infringe on patents held by Masimo, a medical technology company in Irvine, Calif.

In court, Masimo detailed how Apple poached its top executives and more than a dozen other employees before later releasing a watch with pulse oximeter capabilities -- whichmeasures the percentage of oxygen that red blood cells carry from the lungs to the body -- that were patented by Masimo. To avoid a complete ban on sales, Apple had two months to cut a deal with Masimo to license its technology, or it could appeal to the Biden administration to reverse the ruling. But Joe Kiani, the chief executive of Masimo, said in an interview that Apple had not engaged in licensing negotiations. Instead, he said that Apple had appealed to President Biden to veto the I.T.C. ruling, which Mr. Kiani knows because the administration contacted Masimo about Apple's request. "They're trying to make the agency look like it's helping patent trolls," Mr. Kiani said of the I.T.C.

Mr. Kiani said that he was willing to sell Apple a chip that Masimo had designed to provide pulse oximeter readings on the Apple Watch. The chip is currently in a Masimo medical watch, called the W1, that is approved by the Food and Drug Administration. The device uses algorithms to process red and near-infrared light to determine how oxygen-rich is the blood in arteries. "If they don't want to use our chip, I'll work with them to make their product good," Mr. Kiani said. "Once it's good enough, I'm happy to give them a license." Apple introduced its first watch with pulse oximetry in 2020. It has included the technology, which it calls "blood oxygen," in subsequent models. But unlike Masimo's W1 device, Apple hasn't had its watches cleared by the F.D.A. for use as a medical device for pulse oximetry.
"The Apple Watch accounts for nearly $20 billion of the company's $383.29 billion in annual sales," notes the NYT. The company is the largest smartwatch seller in the world, accounting for about a third of all smartwatch sales.
DRM

'Copyright Troll' Porn Company 'Makes Millions By Shaming Porn Consumers' (yahoo.com) 100

In 1999 Los Angeles Times reporter Michael Hiltzik co-authored a Pulitzer Prize-winning story. Now a business columnist for the Times, he writes that a Southern California maker of pornographic films named Strike 3 Holdings is also "a copyright troll," according to U.S. Judge Royce C. Lamberth: Lamberth cwrote in 2018, "Armed with hundreds of cut-and-pasted complaints and boilerplate discovery motions, Strike 3 floods this courthouse (and others around the country) with lawsuits smacking of extortion. It treats this Court not as a citadel of justice, but as an ATM." He likened its litigation strategy to a "high-tech shakedown." Lamberth was not speaking off the cuff. Since September 2017, Strike 3 has filed more than 12,440 lawsuits in federal courts alleging that defendants infringed its copyrights by downloading its movies via BitTorrent, an online service on which unauthorized content can be accessed by almost anyone with a computer and internet connection.

That includes 3,311 cases the firm filed this year, more than 550 in federal courts in California. On some days, scores of filings reach federal courthouses — on Nov. 17, to select a date at random, the firm filed 60 lawsuits nationwide... Typically, they are settled for what lawyers say are cash payments in the four or five figures or are dismissed outright...

It's impossible to pinpoint the profits that can be made from this courthouse strategy. J. Curtis Edmondson, a Portland, Oregon, lawyer who is among the few who pushed back against a Strike 3 case and won, estimates that Strike 3 "pulls in about $15 million to $20 million a year from its lawsuits." That would make the cases "way more profitable than selling their product...." If only one-third of its more than 12,000 lawsuits produced settlements averaging as little as $5,000 each, the yield would come to $20 million... The volume of Strike 3 cases has increased every year — from 1,932 in 2021 to 2,879 last year and 3,311 this year.

What's really needed is a change in copyright law to bring the statutory damages down to a level that truly reflects the value of a film lost because of unauthorized downloading — not $750 or $150,000 but perhaps a few hundred dollars.

Anone of the lawsuits go to trial. Instead ISPs get a subpoena demanding the real-world address and name behind IP addresses "ostensibly used to download content from BitTorrent..." according to the article. Strike 3 will then "proceed by sending a letter implicitly threatening the subscriber with public exposure as a pornography viewer and explicitly with the statutory penalties for infringement written into federal copyright law — up to $150,000 for each example of willful infringement and from $750 to $30,0000 otherwise."

A federal judge in Connecticut wrote last year that "Given the nature of the films at issue, defendants may feel coerced to settle these suits merely to prevent public disclosure of their identifying information, even if they believe they have been misidentified."

Thanks to Slashdot reader Beerismydad for sharing the article.
Medicine

US Pharmacies Share Medical Data with Police Without a Warrant, Inquiry Finds (msn.com) 23

The Washington Post reports that America's largest pharmacy chains have "handed over Americans' prescription records to police and government investigators without a warrant, a congressional investigation found, raising concerns about threats to medical privacy." Though some of the chains require their lawyers to review law enforcement requests, three of the largest — CVS Health, Kroger and Rite Aid, with a combined 60,000 locations nationwide — said they allow pharmacy staff members to hand over customers' medical records in the store... Pharmacies' records hold some of the most intimate details of their customers' personal lives, including years-old medical conditions and the prescriptions they take for mental health and birth control. Because the chains often share records across all locations, a pharmacy in one state can access a person's medical history from states with more-restrictive laws. Carly Zubrzycki, an associate professor at the University of Connecticut law school, wrote last year that this could link a person's out-of-state medical care via a "digital trail" back to their home state...

In briefings, officials with eight American pharmacy giants — Walgreens Boots Alliance, CVS, Walmart, Rite Aid, Kroger, Cigna, Optum Rx and Amazon Pharmacy — told congressional investigators that they required only a subpoena, not a warrant, to share the records.

A subpoena can be issued by a government agency and, unlike a court order or warrant, does not require a judge's approval. To obtain a warrant, law enforcement must convince a judge that the information is vital to investigate a crime. Officials with CVS, Kroger and Rite Aid said they instruct their pharmacy staff members to process law enforcement requests on the spot, saying the staff members face "extreme pressure to immediately respond," the lawmakers' letter said. The eight pharmacy giants told congressional investigators that they collectively received tens of thousands of legal demands every year, and that most were in connection with civil lawsuits. It's unclear how many were related to law enforcement demands, or how many requests were fulfilled.

Only one of the companies, Amazon, said it notified customers when law enforcement demanded its pharmacy records unless there was a legal prohibition, such as a "gag order," preventing it from doing so, the lawmakers said...

Most investigative requests come with a directive requiring the company to keep them confidential, a CVS spokeswoman said; for those that don't, the company considers "on a case-by-case basis whether it's appropriate to notify the individual."

The article points out that Americans "can request the companies tell them if they've ever disclosed their data...but very few people do.

"CVS, which has more than 40,000 pharmacists and 10,000 stores in the United States, said it received a 'single-digit number' of such consumer requests last year, the letter states."
The Courts

TikTok Requires Users To 'Forever Waive' Rights To Sue Over Past Harms (arstechnica.com) 23

An anonymous reader quotes a report from Ars Technica: Some TikTok users may have skipped reviewing an update to TikTok's terms of service this summer that shakes up the process for filing a legal dispute against the app. According to The New York Times, changes that TikTok "quietly" made to its terms suggest that the popular app has spent the back half of 2023 preparing for a wave of legal battles. In July, TikTok overhauled its rules for dispute resolution, pivoting from requiring private arbitration to insisting that legal complaints be filed in either the US District Court for the Central District of California or the Superior Court of the State of California, County of Los Angeles. Legal experts told the Times this could be a way for TikTok to dodge arbitration claims filed en masse that can cost companies millions more in fees than they expected to pay through individual arbitration.

Perhaps most significantly, TikTok also added a section to its terms that mandates that all legal complaints be filed within one year of any alleged harm caused by using the app. The terms now say that TikTok users "forever waive" rights to pursue any older claims. And unlike a prior version of TikTok's terms of service archived in May 2023, users do not seem to have any options to opt out of waiving their rights. Lawyers told the Times that these changes could make it more challenging for TikTok users to pursue legal action at a time when federal agencies are heavily scrutinizing the app and complaints about certain TikTok features allegedly harming kids are mounting.

Cellphones

Suspects Can Refuse To Provide Phone Passcodes To Police, Court Rules (arstechnica.com) 64

An anonymous reader quotes a report from Ars Technica: Criminal suspects can refuse to provide phone passcodes to police under the US Constitution's Fifth Amendment privilege against self-incrimination, according to a unanimous ruling issued (PDF) today by Utah's state Supreme Court. The questions addressed in the ruling could eventually be taken up by the US Supreme Court, whether through review of this case or a similar one. The case involves Alfonso Valdez, who was arrested for kidnapping and assaulting his ex-girlfriend. Police officers obtained a search warrant for the contents of Valdez's phone but couldn't crack his passcode.

Valdez refused to provide his passcode to a police detective. At his trial, the state "elicited testimony from the detective about Valdez's refusal to provide his passcode when asked," today's ruling said. "And during closing arguments, the State argued in rebuttal that Valdez's refusal and the resulting lack of evidence from his cell phone undermined the veracity of one of his defenses. The jury convicted Valdez." A court of appeals reversed the conviction, agreeing "with Valdez that he had a right under the Fifth Amendment to the United States Constitution to refuse to provide his passcode, and that the State violated that right when it used his refusal against him at trial." The Utah Supreme Court affirmed the court of appeals ruling.

The Valdez case does not involve an order to compel a suspect to unlock a device. Instead, "law enforcement asked Valdez to verbally provide his passcode," Utah justices wrote. "While these circumstances involve modern technology in a scenario that the Supreme Court has not yet addressed, we conclude that these facts present a more straightforward question that is answered by settled Fifth Amendment principles." Ruling against the state, the Utah Supreme Court said it "agree[s] with the court of appeals that verbally providing a cell phone passcode is a testimonial communication under the Fifth Amendment."

Crime

Cloud Engineer Gets 2 Years For Wiping Ex-Employer's Code Repos (bleepingcomputer.com) 121

Bill Toulas reports via BleepingComputer: Miklos Daniel Brody, a cloud engineer, was sentenced to two years in prison and a restitution of $529,000 for wiping the code repositories of his former employer in retaliation for being fired by the company. According to the U.S. Department of Justice (DoJ) announcement, Brody was fired on March 11, 2020, from First Republic Bank (FRB) in San Francisco, where he worked as a cloud engineer. The court documents state that Brody's employment was terminated after he violated company policies by connecting a USB drive containing pornography to company computers.

Following his dismissal, Brody allegedly refused to return his work laptop and instead used his still-valid account to access the bank's computer network and cause damages estimated to be above $220,000. "Among other things, Brody deleted the bank's code repositories, ran a malicious script to delete logs, left taunts within the bank's code for former colleagues, and impersonated other bank employees by opening sessions in their names," describes the U.S. DOJ announcement. "He also emailed himself proprietary bank code that he had worked on as an employee, which was valued at over $5,000."

After the incident, Brody falsely reported to the San Francisco Police Department that the FRB-issued laptop had been stolen from his car. He continued to uphold this story when interviewed by United States Secret Service agents following his arrest in March 2021. Eventually, in April 2023, Brody pleaded guilty to lying about the laptop and to two charges concerning violation of the Computer Fraud and Abuse Act. In addition to the two-year prison term and the payment of the restitution, Brody will serve three years of supervised release.

Microsoft

FTC Wants Microsoft's Relationship With OpenAI Under the Microscope (theregister.com) 13

The FTC is considering an investigation into Microsoft's investment in OpenAI to determine if the company broke any antitrust laws. The Register reports: Despite the money poured into it over the years, OpenAI was founded as a non-profit in 2015, and Microsoft's investment does not amount to control of the company. Microsoft chief communications officer Frank X Shaw underlined attempts to dampen down industry talk of a probe: "While details of our agreement remain confidential, it is important to note that Microsoft does not own any portion of OpenAI and is simply entitled to share of profit distributions."

At the end of last week, the UK's Competition and Markets Authority (CMA) launched a consultation to ask interested parties to comment on Microsoft's relationship with ChatGPT developer, and if it could be construed as a merger that potentially skews competition. If so, the CMA will itself launch an official inspection.

The Courts

Google's App Store Ruled an Illegal Monopoly, as a Jury Sides With Epic Games (wired.com) 103

A jury in San Francisco unanimously found (PDF) that Google violated California and federal antitrust laws through deals that stifled competition for its mobile app store. "The verdict delivers the first significant US courtroom loss for big tech in the years-long campaign by rivals, regulators, and prosecutors to tame the power of internet gatekeepers," reports Wired. From the report: The lawsuit next moves to a remedies phase, meaning a judge as soon as the coming weeks will hear arguments about and decide whether to order changes to Google's business practices. Users of devices powered by Google's Android operating system could find more app options to choose from, at lower prices, if Google is forced to allow downloads of rival app stores from Play or share a greater portion of sales with developers selling digital items inside their apps.

The ruling came in a case first filed in 2020 by Epic Games, known for its blockbuster game Fortnite and tools for developers, and argued before a jury since early November. The jury of nine -- a 10th juror dropped out early in the trial -- deliberated for three hours before reaching its verdict. They faced 11 questions such as defining product and geographic markets and whether Google engaged in anticompetitive conduct in those areas. Epic had accused Google of restricting smartphone makers, wireless carriers, and app developers from providing any competition to the Play store, which accounts for over 95 percent of all downloads onto Android phones in the US. Google had denied any wrongdoing, saying that its sole aim was to provide a safe and attractive experience to users, especially as it faced competition from Apple, its iPhone, and its App Store.

Patents

White House Threatens Patents of High-Priced Drugs (apnews.com) 151

The Biden administration is threatening to cancel the patents of some costly medications to allow rivals to make their own more affordable versions. The Associated Press reports: Under a plan announced Thursday, the government would consider overriding the patent for high-priced drugs that have been developed with the help of taxpayer money and letting competitors make them in hopes of driving down the cost. In a 15-second video released to YouTube on Wednesday night, President Joe Biden promised the move would lower prices. "Today, we're taking a very important step toward ending price gouging so you don't have to pay more for the medicine you need," he said.

White House officials would not name drugs that might potentially be targeted. The government would consider seizing a patent if a drug is only available to a "narrow set of consumers," according to the proposal that will be open to public comment for 60 days. Drugmakers are almost certain to challenge the plan in court if it is enacted. [...] The White House also intends to focus more closely on private equity firms that purchase hospitals and health systems, then often whittle them down and sell quickly for a profit. The departments of Justice and Health and Human Services, and the Federal Trade Commission will work to share more data about health system ownership.

While only a minority of drugs on the market relied so heavily on taxpayer dollars, the threat of a government "march-in" on patents will make many pharmaceutical companies think twice, said Jing Luo, a professor of medicine at University of Pittsburgh. "If I was a drug company that was trying to license a product that had benefited heavily from taxpayer money, I'd be very careful about how to price that product," Luo said. "I wouldn't want anyone to take my product away from me."

Privacy

Verizon Gave Phone Data To Armed Stalker Who Posed As Cop Over Email (404media.co) 27

Slash_Account_Dot writes: The FBI investigated a man who allegedly posed as a police officer in emails and phone calls to trick Verizon to hand over phone data belonging to a specific person that the suspect met on the dating section of porn site xHamster, according to a newly unsealed court record. Despite the relatively unconvincing cover story concocted by the suspect, including the use of a clearly non-government ProtonMail email address, Verizon handed over the victim's data to the alleged stalker, including their address and phone logs. The stalker then went on to threaten the victim and ended up driving to where he believed the victim lived while armed with a knife, according to the record.

The news is a massive failure by Verizon who did not verify that the data request was fraudulent, and the company potentially put someone's safety at risk. The news also highlights the now common use of fraudulent emergency data requests (EDRs) or search warrants in the digital underworld, where criminals pretend to be law enforcement officers, fabricate an urgent scenario such as a kidnapping, and then convince telecoms or tech companies to hand over data that should only be accessible through legitimate law enforcement requests. As 404 Media previously reported, some hackers are using compromised government email accounts for this purpose.

Businesses

Amazon Says Thieves Swiped Millions by Faking Product Refunds (bloomberg.com) 26

Amazon sued what it called an international ring of thieves who swiped millions of dollars in merchandise from the company through a series of refund scams that included buying products on Amazon and seeking refunds without returning the goods. From a report: An organization called REKK advertised its refund services on social media sites, including Reddit and Discord, and communicated with perpetrators on the messaging app Telegram, Amazon said in a lawsuit filed Thursday in US District Court in the state of Washington.

The lawsuit names REKK and nearly 30 people from the US, Canada, UK, Greece, Lithuania and the Netherlands as defendants in the scheme, which involved hacking into Amazon's internal systems and bribing Amazon employees to approve reimbursements. REKK charged customers, who wanted to get pricey items like MacBook Pro laptops and car tires without paying for them, a commission based on the value of the purchase. "The defendants' scheme tricks Amazon into processing refunds for products that are never returned; instead of returning the products as promised, defendants keep the product and the refund," Amazon said in its lawsuit.

Slashdot Top Deals