Russia has hit Google with a $373 million fine for failing to restrict access to "prohibited" material about the war in Ukraine and other content. The BBC reports: Roskomnadzor, the country's communications regulator, said the information included "fake" reports that discredited Russia's military and posts urging people to protest. It called the US tech giant a "systematic" violator of its laws. Google did not comment immediately.

The company's local subsidiary declared bankruptcy last month. The move came after Russian authorities seized its local bank account, allowing them to recover 7.2bn roubles that the firm had been ordered to pay for similar reasons last year. [...] The fine announced on Monday, which was calculated as a share of the firm's local revenue, marks the biggest penalty ever imposed on a tech company in Russia, according to state media.

An anonymous reader quotes a report from Politico: The Trump administration's immigration enforcers used mobile location data to track people's movements on a larger scale than previously known, according to documents that raise new questions about federal agencies' efforts to get around restrictions on warrantless searches. The data, harvested from apps on hundreds of millions of phones, allowed the Department of Homeland Security to obtain data on more than 336,000 location data points across North America, the documents show. Those data points may reference only a small portion of the information that CBP has obtained.

These data points came from all over the continent, including in major cities like Los Angeles, New York, Chicago, Denver, Toronto and Mexico City. This location data use has continued into the Biden administration, as Customs and Border Protection renewed a contract for $20,000 into September 2021, and Immigration and Customs Enforcement signed another contract in November 2021 that lasts until June 2023. The American Civil Liberties Union obtained the records from DHS through a lawsuit it filed in 2020. It provided the documents to POLITICO and separately released them to the public on Monday.

The documents highlight conversations and contracts between federal agencies and the surveillance companies Babel Street and Venntel. Venntel alone boasts that its database includes location information from more than 250 million devices. The documents also show agency staff having internal conversations about privacy concerns on using phone location data. In just three days in 2018, the documents show that the CBP collected data from more than 113,000 locations from phones in the Southwestern United States -- equivalent to more than 26 data points per minute -- without obtaining a warrant. The documents highlight the massive scale of location data that government agencies including CBP and ICE received, and how the agencies sought to take advantage of the mobile advertising industry's treasure trove of data. "It was definitely a shocking amount," said Shreya Tewari, the Brennan fellow for the ACLU's Speech, Privacy and Technology Project. "It was a really detailed picture of how they can zero in on not only a specific geographic area, but also a time period, and how much they're collecting and how quickly."

Imagine you are working on your novel on your home computer. It's nearly finished; you have already written approximately one million words. All of a sudden, the online word processing software tells you that you can no longer open the draft because it contains illegal information. Within an instant, all your words are lost. This is what happened in June to a Chinese novelist writing under the alias Mitu. From a report: She had been working with WPS, a domestic version of cloud-based word processing software such as Google Docs or Microsoft Office 365. In the Chinese literature forum Lkong on June 25, Mitu accused WPS of "spying on and locking my draft," citing the presence of illegal content.

The news blew up on social media on July 11 after a few prominent influencer accounts belatedly picked it up. It became the top trending topic on Weibo that day, with users questioning whether WPS is infringing on their privacy. Since then, The Economic Observer, a Chinese publication, has reported that several other online novelists have had their drafts locked for unclear reasons in the past. Mitu's complaint triggered a social media discussion in China about censorship and tech platform responsibility. It has also highlighted the tension between Chinese users' increasing awareness of privacy and tech companies' obligation to censor on behalf of the government. "This is a case where perhaps we are seeing that these two things indeed might collide," says Tom Nunlist, an analyst on China's cyber and data policy at the Beijing-based research group Trivium China.

"Facebook has started to use a different URL scheme for site links," writes the technology blog Ghacks, "to combat URL stripping technologies that browsers such as Firefox or Brave use to improve privacy and prevent user tracking." Some sites, including Facebook, add parameters to the web address for tracking purposes. These parameters have no functionality that is relevant to the user, but sites rely on them to track users across pages and properties. Mozilla introduced support for URL stripping in Firefox 102, which it launched in June 2022. Firefox removes tracking parameters from web addresses automatically, but only in private browsing mode or when the browser's Tracking Protection feature is set to strict. Firefox users may enable URL stripping in all Firefox modes, but this requires manual configuration. Brave Browser strips known tracking parameters from web addresses as well....

It is no longer possible to remove the tracking part of the URL, as Facebook merged it with part of the required web address.

Black Parrot (Slashdot reader #19,622) shared this report from ScienceInsider: When the U.S. government released a much-anticipated report on UFOs a year ago, many were perplexed that it couldn't explain 143 of the 144 sightings it examined. (In the single closed case, the report concluded the mystery object was a large, deflating balloon.) "Where are the aliens?" cracked one headline.

The truth was still out there. So was any sense of who had conducted the analysis, because the Office of the Director of National Intelligence, which released the study, provided no details about who had investigated the cases. Last week, however, a former Department of Defense astrophysicist and reality TV personality named Travis Taylor asserted that he was the 'chief scientist' for the congressionally mandated study. The revelation shocked UFO skeptics in the science community. They note that Taylor has made extraordinary claims during TV appearances, including to have "seen more UFOs than I can count," and that he's been tracked by supernatural entities that caused his car and appliances to malfunction....

In fact, Taylor did serve in a lead role with the government's Unidentified Aerial Phenomena (UAP) Task Force, which produced 2021's fuzzy UFO report, Pentagon spokesperson Susan Gough confirmed to ScienceInsider. But Taylor was "informally referred to ... as the chief scientist as efforts to assemble a larger team were underway," and it was not a full-time position. (Taylor did not respond to requests for comment....)

Taylor's critics are simply astonished by what they call his antiscientific embrace of the supernatural — and the Pentagon's willingness to work with him. "I'm starting to see why [the government's] task force was so unsuccessful in identifying its Unidentified Aerial Phenomena!" wrote Robert Sheaffer, a UFO skeptic and author, on his blog.

Two members of the U.S. Congress urged America's Federal Trade Commission "to address deceptive practices in the Virtual Private Network industry," reports the Verge: With abortion becoming illegal or restricted in several states, more people are looking to conceal their messages and search history, as police can use this information to prosecute someone seeking the procedure. In their letter, Anna Eshoo (D-CA) and Senator Ron Wyden ask the FTC to clamp down on VPN providers that engage in deceptive advertising, or make false assertions about the range of their service's privacy. The lawmakers cite research from Consumer Reports that indicate 75 percent of the most popular VPNs "misrepresented their products" or made misleading claims that could give "abortion-seekers a false sense of security." Eshoo and Wyden also call attention to reports accusing various VPN services of misusing user data, as well as "a lack of practical tools or independent research to audit VPN providers' security claims...."

"We urge the Federal Trade Commission to take immediate action... to curtail abusive and deceptive data practices in companies providing VPN services to protect internet users seeking abortions." Eshoo and Wyden also ask that the FTC develop a brochure that informs anyone seeking an abortion about online privacy, as well as outlines the risks and benefits of using a VPN.

The Washington Post reports: In the frantic first weeks of Russia's invasion of Ukraine, the U.S. tech companies that control the world's largest information hubs sprang into action. Responding to pressure from Western governments, social media apps such as Facebook, Instagram and YouTube banned or throttled Russian state media accounts, beefed up their fact-checking operations, curtailed ad sales in Russia and opened direct lines to Ukrainian officials, inviting them to flag Russian disinformation and propaganda to be taken down.

As the war grinds toward its sixth month, however, Russian propaganda techniques have evolved — and the tech firms haven't kept up.

Ukrainian officials who have flagged thousands of tweets, YouTube videos and other social media posts as Russian propaganda or anti-Ukrainian hate speech say the companies have grown less responsive to their requests to remove such content. New research shared with The Washington Post by a Europe-based nonprofit initiative confirms that many of those requests seem to be going unheeded, with accounts parroting Kremlin talking points, spewing anti-Ukrainian slurs or even impersonating Ukrainian officials remaining active on major social networks. As a result, researchers say, Kremlin-backed narratives are once again propagating across Europe, threatening to undermine popular support for Ukraine in countries that it views as critical to its defense....

With big state media accounts suspended or muffled, researchers say Russian leaders and influencers have shifted to the semiprivate messaging app Telegram to direct information campaigns via swarms of smaller accounts.
The Post reports that Google-owned YouTube hasn't returned emails for almost two months, according to the deputy head of the Ukrainian government's Strategic Communications and Information Security center. And the Post notes that researchers found LinkedIn "removed fewer than half of the posts that Ukrainian officials flagged as examples of Russian propaganda justifying the war....

"On the positive side, the researchers found that Facebook had removed all 98 of the posts the Ukrainian government and its partners flagged as containing anti-Ukrainian hate speech, though many of the accounts responsible remained active."

"5G iPhones have been slapped with a sales ban in Colombia," reports Digital Trends, "due to a 5G patent infringement dispute between Apple and Ericsson... The ban affects the latest models, including the iPhone 12, iPhone 13, and the iPad Pro, which the court found infringed Ericsson's patent pertaining to 5G tech."

They add that in response Apple is now suing Ericsson in Texas, "for damages that resulted from the ruling in Colombia, as well as any fines, fees, penalties, and costs that have been incurred because of it."

The site FOSS Patents notes that Colombia reached the "banning" stage less than six months after the beginning of "the current wave of Ericsson v. Apple patent infringement actions." ZDNet explains: The backstory here is somewhat complicated but can be boiled down to the following points:

- Apple used to pay Ericsson royalty fees for patented 5G technologies.
- Apple failed to renew the licenses when they expired.
- Ericsson sued Apple.
- Apple then sued Ericsson, claiming that the company was violating FRAND rules, the patents were standard-essential patents, and Ericsson's licensing fees were too high.

There followed a whole bunch of legal actions and counteractions, with both companies attempting to get sales bans on the other company's hardware....

This ban is likely no big deal for Apple given the small size of that market. The problem is several more lawsuits are making their way through various courts in various territories. And since Apple isn't disputing the validity of the patents, it's almost certainly opening itself out to bans being enforced in other countries.
Thanks to long-time Slashdot reader fermion for sharing the news!

"Russian President Vladimir Putin approved a law Friday prohibiting the use of digital assets as forms of payments in Russia..." reports the tech/policy news site Protocol. The ban on crypto-form payments also apparently applies to NFTs: The new law also includes a provision that requires crypto exchanges and providers refuse transactions in which digital assets could be construed as a form of payment... The new law is set to take effect in 10 days.

There's been some speculation that sanctioned Russian companies or individuals might use crypto to avoid sanctions imposed after the country's invasion of Ukraine. But officials have proven savvy in using on-chain analytics to trace transactions, and industry experts have warned that sanctions evaders would be ill-served by trying to use cryptocurrencies. U.S. and EU bodies have even added specific crypto wallet addresses to sanction lists.

"TikTok is resisting calls to preserve and hand over access to its content for war crime investigations," reports the Financial Times, "as lawyers and activists warn that the Chinese-owned app is a major data challenge in prosecuting atrocities in Russia's invasion of Ukraine." The video app's popularity with young Ukrainians and Russians posting footage of the war has made it a trove of digital intelligence that investigators are attempting to mine and archive as evidence of war crimes, crimes against humanity, and illegal acts of violence in Ukraine....

"I have concerns about the security of data there, and it is not fully clear where the interest and influence in the company is coming from," said Dia Kayyali, associate director for advocacy at Mnemonic, a nonprofit that archives digital documentation of human rights violations. "It is especially concerning that China could directly have access to that data...." Since early 2022, TikTok has met with human rights lawyers, activists, and others involved in Ukraine war crime investigations. However, it has yet to introduce any changes to its process or the product itself.

Criminal prosecutors are increasingly relying on social media posts from TikTok and others as a way to "bring the crime scene to the courtroom," said Karim Khan, chief prosecutor of the International Criminal Court. "Any effective investigation anywhere in the world now really requires a very effective harnessing of social media," said Khan. "People... recording killings or attacks or the consequences of attacks in real time, it can have absolutely fantastic probative value...."

TikTok said it regularly meets with organizations, government bodies, and third-party experts to gather feedback and is committed to cooperating with law enforcement while respecting the privacy of its users.

An anonymous reader quotes a report from Wired: [R]esearchers from the New Jersey Institute of Technology are warning this week about a novel technique attackers could use to de-anonymize website visitors and potentially connect the dots on many components of targets' digital lives. The findings (PDF), which NJIT researchers will present at the Usenix Security Symposium in Boston next month, show how an attacker who tricks someone into loading a malicious website can determine whether that visitor controls a particular public identifier, like an email address or social media account, thus linking the visitor to a piece of potentially personal data.

When you visit a website, the page can capture your IP address, but this doesn't necessarily give the site owner enough information to individually identify you. Instead, the hack analyzes subtle features of a potential target's browser activity to determine whether they are logged into an account for an array of services, from YouTube and Dropbox to Twitter, Facebook, TikTok, and more. Plus the attacks work against every major browser, including the anonymity-focused Tor Browser. "If you're an average internet user, you may not think too much about your privacy when you visit a random website," says Reza Curtmola, one of the study authors and a computer science professor at NJIT. "But there are certain categories of internet users who may be more significantly impacted by this, like people who organize and participate in political protest, journalists, and people who network with fellow members of their minority group. And what makes these types of attacks dangerous is they're very stealthy. You just visit the website and you have no idea that you've been exposed."

How this de-anonymization attack works is difficult to explain but relatively easy to grasp once you have the gist. Someone carrying out the attack needs a few things to get started: a website they control, a list of accounts tied to people they want to identify as having visited that site, and content posted to the platforms of the accounts on their target list that either allows the targeted accounts to view that content or blocks them from viewing it -- the attack works both ways. Next, the attacker embeds the aforementioned content on the malicious website. Then they wait to see who clicks. If anyone on the targeted list visits the site, the attackers will know who they are by analyzing which users can (or cannot) view the embedded content. [...] Complicated as it may sound, the researchers warn that it would be simple to carry out once attackers have done the prep work. It would only take a couple of seconds to potentially unmask each visitor to the malicious site -- and it would be virtually impossible for an unsuspecting user to detect the hack. The researchers developed a browser extension that can thwart such attacks, and it is available for Chrome and Firefox. But they note that it may impact performance and isn't available for all browsers.

An anonymous reader quotes a report from BleepingComputer: The Tor Project team has announced the release of Tor Browser 11.5, a major release that brings new features to help users fight censorship easier. [...] The updates in Tor Browser 11.5 focus on circumventing censorship, a process that started a year ago in version 10.5 with improving the Tor connection experience. In the new version, users no longer have to manually try out bridge configurations to unblock Tor.

Tor Browser version 11.5 comes with a new feature called "Connection Assist," which assigns automatically the bridge configuration known to work best for the user's location. "Connection Assist works by looking up and downloading an up-to-date list of country-specific options to try using your location (with your consent)," explains the release announcement. "It manages to do so without needing to connect to the Tor Network first by utilizing moat – the same domain-fronting tool that Tor Browser uses to request a bridge from torproject.org." Since Connection Assist is still in an early stage of development (v1.0), the Tor team welcomes user feedback and reports, which would help them iron out any kinks and improve on the system.

Another important new feature in version 11.5 is making 'HTTPS-Only Mode' the default browsing mode, so that the connection is through a secure tunnel. This ensures that all data exchange between the user and the server hosting the website will be encrypted, to defend against man-in-the-middle (MitM) attacks and to protect users from SSL stripping on malicious exit relays. [...] The third significant improvement in Tor Browser 11.5 is a heavily revamped Network Settings menu, now called "Connection Settings," which should make it easier to find and understand specific settings. Most notably, bridge configuration and connection options have been redesigned to enable quick and easy review and management. Using emojis on the saved Bridges, the new interface offers visualization for the configuration for the first time, making it easy to identify the right bridge and select it when needed. You can download the latest Tor Browser from the official download portal.

An anonymous reader quotes a report from TechCrunch: A major populist but controversial piece of U.K. legislation to regulate internet content through a child safety-focused frame is on pause until the fall when the government expects to elect a new prime minister, following the resignation of Boris Johnson as Conservative Party leader last week. PoliticsHome reported yesterday that the Online Safety Bill would be dropped from House of Commons business next week with a view to being returned in the autumn. The Department for Digital, Culture, Media and Sport (DCMS) denied the legislation was being dropped altogether but the fate of the bill will clearly now rest with the new prime minister -- and their appetite for regulating online speech.

Reached for comment, DCMS confirmed that the bill's final day of report stage will be rescheduled to after the summer recess -- suggesting it had lost out to competing demands for remaining parliamentary time (without specifying to what). The department also made a point of reiterating that the legislation intends to deliver on the government's manifesto commitment to make the U.K. the safest place in the world to be online while defending freedom of speech. But critics of the bill continue to warn it vastly overreaches on content regulation while saddling the U.K.'s digital sector with crippling compliance costs.

Chat service Omegle is on the hook for a lawsuit after its matching system paired an 11-year-old girl with a man who then sexually abused her. A district judge in Portland, Oregon, said the company's system wasn't protected by the legal shield that covers much user-generated content. From a report: The case isn't concluded, but it opens the door to more prosecutions based on how a platform designs its services. The legal complaint, filed late last year, alleges that Omegle's service was defective and falsely represented. It's a common strategy that's often failed in court before, including with Grindr in a harassment case, typically due to the legal protections of Section 230 of the Communications Decency Act. This time, however, Judge Michael Mosman determined that the lawsuit targeted functions specifically designed by Omegle rather than speech by other users on the platform.

India has proposed to introduce a right to repair law, aiming to provide consumers the ability to have their devices repaired by third parties to fight the growing "culture of planned obsolescence" in a move that follows similar deliberations in the U.S. and the UK. From a report: The Indian Department of Consumer Affairs said Wednesday that it had set up a committee to develop a right to repair framework. The committee identified mobile phones, tablets, consumer durables, automobiles and farming as important sectors for the framework, the ministry said. "The pertinent issues highlighted during the meeting include companies avoiding the publication of manuals that can help users make repairs easily," the ministry said in a statement.

A former Central Intelligence Agency software engineer was convicted by a federal jury on Wednesday of causing the largest theft of classified information in the agency's history. From a report: The former C.I.A. employee, Joshua Schulte, was arrested after the 2017 disclosure by WikiLeaks of a trove of confidential documents detailing the agency's secret methods for penetrating the computer networks of foreign governments and terrorists. The verdict came two years after a previous jury failed to agree on eight of the 10 charges he faced then.

At the earlier trial, Mr. Schulte, 33, was found guilty of contempt of court and of making false statements to the F.B.I. He was convicted on Wednesday on nine counts, which included illegally gathering national defense information and illegally transmitting that information. Damian Williams, the United States attorney in Manhattan, where the trial was held, hailed the verdict. Mr. Schulte has been convicted of "one of the most brazen and damaging acts of espionage in American history," Mr. Williams said in a statement.

An anonymous reader quotes a report from Popular Science: Internet Archive, a non-profit digital library and a massive repository of online artifacts, has been collecting mementos of the ever-expanding World Wide Web for over two decades, allowing users to revisit sites that have since been changed or deleted. But like the web, it too has evolved since its genesis, and in the aughts, it also began to offer a selection of ebooks that any internet user can check out with the creation of a free account. That latter feature has gotten the organization in some trouble. Internet Archive was sued by a suite of four corporate publishers in 2020 over copyright controversies -- with one side saying that what Internet Archive does is preservation, and the other saying that it's piracy, since it freely distributes books as image files without compensating the author. Last week, the ongoing case entered a new chapter as the nonprofit organization filed a motion for summary judgment, asking a federal judge to put a stop to the lawsuit, arguing that their Controlled Digital Lending program "is a lawful fair use that preserves traditional library lending in the digital world" since "each book loaned via CDL has already been bought and paid for." On Friday, Creative Commons issued a statement supporting Internet Archive's motion.

In 2006, Internet Archive started a program for digitizing books both under copyright and in the public domain. It works with a range of global partners, including other libraries, to scan materials onto its site (Cornell University made a handy guide on what works fall under copyright vs. the public domain). For copyrighted books, Internet Archive owns the physical books that they created the digital copies from and limits their circulation by allowing only one person to borrow a title at a time. Book publishers, namely Hachette Book Group, HarperCollins, John Wiley Sons, and Penguin Random House, were not keen on this practice, and they have been seeking financial damages for the 127 books (PDF) shared under copyright. Vox estimated that if the publishers win, Internet Archive would have to pay $19 million, which is about "one year of operating revenue."

In the most recent filings, the publishers accused Internet Archive of amassing "a collection of more than three million unauthorized in-copyright ebooks -- including more than 33,000 of the Publishers' commercially available titles -- without obtaining licenses to do so or paying the rightsholders a cent for exploiting their works. Anybody in the world with an internet connection can instantaneously access these stolen works via IA's interrelated archive.org and openlibrary.org websites." In its defense, Internet Archive, which is being represented by the Electronic Frontier Foundation, says that "libraries have been practicing CDL in one form or another for more than a decade," and that Internet Archive lends its digitized books on an "owned-to-loaned basis, backstopped by strong technical protections to enforce lending limits."

Google has counter-sued Match seeking monetary damages and a judgement that would let it kick Tinder and the group's other dating apps out of the Play Store, Bloomberg has reported. Engadget reports: Earlier this year, Match sued Google alleging antitrust violations over a decision requiring all Android developers to process "digital goods and services" payments through the Play Store billing system. Following the initial lawsuit in May, Google and Match reached a temporary agreement allowing Match to remain on the Play Store and use its own payments system. Google also agreed to make a "good faith" effort to address Match's billing concerns. Match, in turn, was to make an effort to offer Google's billing system as an alternative.

However, Google parent Alphabet claims that Match Group now wants to avoid paying "nothing at all" to Google, including its 15 to 30 percent Play Store fees, according to a court filing. "Match Group never intended to comply with the contractual terms to which it agreed... it would also place Match Group in an advantaged position relative to other app developers," the document states. Match group said that Google's Play Store policies violate federal and state laws. "Google doesn't want anyone else to sue them so their counterclaims are designed as a warning shot," Match told Bloomberg in a statement. "We are confident that our suit, alongside other developers, the US Department of Justice and 37 state attorneys general making similar claims, will be resolved in our favor early next year."

An anonymous reader shares a report: Ring, Amazon's perennially controversial and police-friendly surveillance subsidiary, has long defended its cozy relationship with law enforcement by pointing out that cops can only get access to a camera owner's recordings with their express permission or a court order. But in response to recent questions from Sen. Ed Markey, D-Mass., the company stated that it has provided police with user footage 11 times this year alone without either. Last month, Markey wrote to Amazon asking it to both clarify Ring's ever-expanding relationship with American police, who've increasingly come to rely on the company's growing residential surveillance dragnet, and to commit to a raft of policy reforms. In a July 1 response from Brian Huseman, Amazon vice president of public policy, the company declined to permanently agree to any of them, including "Never accept financial contributions from policing agencies," "Never allow immigration enforcement agencies to request Ring recordings," and "Never participate in police sting operations."

Although Ring publicizes its policy of handing over camera footage only if the owner agrees -- or if judge signs a search warrant -- the company says it also reserves the right to supply police with footage in "emergencies," defined broadly as "cases involving imminent danger of death or serious physical injury to any person." Markey had also asked Amazon to clarify what exactly constitutes such an "emergency situation," and how many times audiovisual surveillance data has been provided under such circumstances.

Early last month, TikTok users across Europe were told that, starting July 13th, the platform would begin using their on-app data to serve up targeted ads, even if those users didn't consent to the practice. Now, less than a day before that change would have rolled out European Union-wide, it looks like the company's reconsidering things a bit. Gizmodo reports: A company spokesperson told TechCrunch on Tuesday that TikTok is "pausing" the update while it "engage[s] on the questions from stakeholders," about the way it handles personalized ads. And needless to say, there are quite a lot of questions about that right now -- from data protection authorities in the EU, from lawmakers in the US, and from privacy experts pretty much everywhere.

For context: until this point, European users that opened the TikTok app needed to offer express consent to let the company use their data for targeted ads. This update planned to do away with the need for that pesky consent by on a legal basis known as "legitimate interest" to target those ads instead. In a nutshell, the "legitimate interest" clause would let TikTok process people's data, consent-free, if it was for a purpose that TikTok deemed reasonable. This means the company could say, for example, that because targeted ads bring in more money than their un-targeted equivalent, it would be reasonable to serve all users -- consenting or otherwise -- targeted ads. Reasonable, right?