Companies are offering interest-free advances to people with poor credit in exchange for detailed personal data. Wired: Tulloch [Editor's note: the anecdote character in the story] is one of a growing number of US workers turning their personal data over to private companies in exchange for paycheck advances, fueling an industry potentially worth up to $12 billion, by some estimates. In 2020, $9.5 billion in wages were accessed early, according to the research firm Aite-Novarica Group, up from $6.3 billion in 2019. These early payouts can be habit-forming; a 2021 report from the Financial Health Network found that more than 70 percent of pay advance users took out consecutive advances.

What Tulloch didn't know was that when he signed up for the app, a company called Argyle was retrieving the data that would be used to decide how much money to give him. It builds the technology that allows companies like B9 to extract a wealth of data from payroll accounts -- up to 140 data points. These can include shifts worked, time off, earnings and promotions history, health care and retirement contributions, even reputational markers like on-time rate or a gig worker's star rating and deactivation history. For every worker that uses its product, Argyle charges customers like B9 a fee, plus an additional monthly charge for continuous monitoring. This makes for a valuable data trove; it's further upstream than banking data, providing a fuller picture of a worker's earnings, deductions, and behavior. Some estimate that payroll data could be worth $10 billion. Argyle pegs it at 10 times higher.

Argyle is part of an emerging set of payroll data companies founded over the last four years to cash in on workers' personal information. They build secure connections between payroll providers like Paychex and businesses that want to access that data, like B9. Argyle acts like a courier, shuttling data from one account to another, the same way banking data is transmitted to apps like Venmo. Its competitors include Atomic, Pinwheel, Truv, and Plaid (which builds those bank integrations but recently began releasing payroll products). The data that workers provide can be used to underwrite financial products like loans, mortgages, insurance policies, and buy-now-pay-later apps; simplify direct deposit switching; or verify income and employment for apartment and job applications.

The Federal Trade Commission sued Intuit in federal court on Monday, claiming it has deceived customers for years by marketing its TurboTax software as free and then charging most users when they file their income taxes. From a report: Around 56 million people filed their taxes with TurboTax in 2021, according to an Inuit shareholder presentation in January. Those individuals filed 54 million W-2 and 40 million 1099 tax forms, the company said. The FTC sued Intuit in U.S. District Court for the Northern District of California, asking for an immediate halt to its "bogus" advertising as taxpayers rush to meet the April 18 deadline to file their 2021 income taxes. The agency also issued a parallel administrative complaint on Monday. That proceeding will determine whether Intuit's conduct violated the FTC Act, the lawsuit said. Much of Intuit's advertising tells consumers they can file their income taxes for free online using TurboTax, but that's not true for most users, including independent contractors in the gig economy who get a 1099 tax form, the FTC said.

Russia's biggest internet company has embedded code into apps found on mobile devices that allows information about millions of users to be sent to servers located in its home country. From a report: The revelation relates to software created by Yandex that permits developers to create apps for devices running Apple's iOS and Google's Android, systems that run the vast majority of the world's smartphones. Yandex collects user data harvested from mobiles, before sending the information to servers in Russia. Researchers have raised concerns the same "metadata" may then be accessed by the Kremlin and used to track people through their mobiles. Researcher Zach Edwards first made the discovery regarding Yandex's code as part of an app auditing campaign for Me2B Alliance, a non-profit. Four independent experts ran tests for the Financial Times to verify his work.

Yandex has acknowledged its software collects "device, network and IP address" information that is stored "both in Finland and in Russia," but it called this data "non-personalised and very limited." It added: "Although theoretically possible, in practice it is extremely hard to identify users based solely on such information collected. Yandex definitely cannot do this." The revelations come at a critical time for Yandex, often referred to as "Russia's Google," which has long attempted to chart an independent path without falling foul of Russian president Vladimir Putin's desire for greater control of the internet. The company said it followed "a very strict" internal process when dealing with governments: "Any requests that fail to comply with all relevant procedural and legal requirements are turned down."

Corin Faife writes via The Verge: On March 24th, EU governing bodies announced that they had reached a deal on the most sweeping legislation to target Big Tech in Europe, known as the Digital Markets Act (DMA). Seen as an ambitious law with far-reaching implications, the most eye-catching measure in the bill would require that every large tech company -- defined as having a market capitalization of more than 75 billion euros or a user base of more than 45 million people in the EU -- create products that are interoperable with smaller platforms. For messaging apps, that would mean letting end-to-end encrypted services like WhatsApp mingle with less secure protocols like SMS -- which security experts worry will undermine hard-won gains in the field of message encryption.

The main focus of the DMA is a class of large tech companies termed "gatekeepers," defined by the size of their audience or revenue and, by extension, the structural power they are able to wield against smaller competitors. Through the new regulations, the government is hoping to "break open" some of the services provided by such companies to allow smaller businesses to compete. That could mean letting users install third-party apps outside of the App Store, letting outside sellers rank higher in Amazon searches, or requiring messaging apps to send texts across multiple protocols. But this could pose a real problem for services promising end-to-end encryption: the consensus among cryptographers is that it will be difficult, if not impossible, to maintain encryption between apps, with potentially enormous implications for users.

Signal is small enough that it wouldn't be affected by the DMA provisions, but WhatsApp -- which uses the Signal protocol and is owned by Meta -- certainly would be. The result could be that some, if not all, of WhatsApp's end-to-end messaging encryption is weakened or removed, robbing a billion users of the protections of private messaging. Given the need for precise implementation of cryptographic standards, experts say that there's no simple fix that can reconcile security and interoperability for encrypted messaging services. Effectively, there would be no way to fuse together different forms of encryption across apps with different design features, said Steven Bellovin, an acclaimed internet security researcher and professor of computer science at Columbia University.

The Lapsus$ hackers used compromised credentials to break into the network of customer service giant Sitel in January, days before subsequently accessing the internal systems of authentication giant Okta, according to documents seen by TechCrunch that provide new details of the cyber intrusion that have not yet been reported. The report adds: [...] The documents provide the most detailed account to date of the Sitel compromise, which allowed the hackers to later gain access to Okta's network. [...] The documents, obtained by independent security researcher Bill Demirkapi and shared with TechCrunch, include a Sitel customer communication sent on January 25 -- more than a week after hackers first compromised its network -- and a detailed timeline of the Sitel intrusion compiled by incident response firm Mandiant dated March 17 that was shared with Okta.

According to the documents, Sitel said it discovered the security incident in its VPN gateways on a legacy network belonging to Sykes, a customer service company working for Okta that Sitel acquired in 2021. The timeline details how the attackers used remote access services and publicly accessible hacking tools to compromise and navigate through Sitel's network, gaining deeper visibility to the network over the five days that Lapsus$ had access. Sitel said that its Azure cloud infrastructure was also compromised by hackers. According to the timeline, the hackers accessed a spreadsheet on Sitel's internal network early on January 21 called "DomAdmins-LastPass.xlsx." The filename suggests that the spreadsheet contained passwords for domain administrator accounts that were exported from a Sitel employee's LastPass password manager.

A group of U.S. lawmakers says the U.S. Treasury Department may be the right government entity to create a digital dollar -- not the Federal Reserve. A new bill introduced Monday would authorize just that. CoinDesk reports: Reps. Stephen Lynch (D-Mass.), Jesus Chuy Garcia (D-Ill.), Ayanna Pressley (D-Mass.) and Rashida Tlaib (D-Mich.) introduced the "Electronic Currency And Secure Hardware Act" (ECASH Act) to direct the Treasury Secretary to develop and issue an electronic version of the U.S. dollar, with an eye to preserving privacy and anonymity in transactions. The electronic dollar, as defined in the bill, would be a bearer instrument that people could hold on their phone or a card. The system would be token-based, not account-based, meaning if someone were to lose their phone or card, they would lose the funds. In other words, it would be like losing a wallet with dollar bills in it. This electronic dollar would be deemed legal tender and be functionally identical to a physical greenback.

Rohan Grey, an assistant professor at Willamette University who consulted on the bill, told CoinDesk the bill is meant to create a true digital analogue to the U.S. dollar. "We're proposing to have a genuine cash-like bearer instrument, a token-based system that doesn't have either a centralized ledger or distributed ledger because it had no ledger whatsoever. It uses secured hardware software and it's issued by the Treasury," he said. This form of e-cash would support peer-to-peer transactions, and given the nature of its setup, it would support fully anonymous transactions. Thus, it would differ from other proposals for a digital dollar, which are based on stablecoins or other decentralized ledger tools. The full text of the E-CASH Bill can be read here.

In 2018 police arrested "the Golden State Killer" — now a 72-year-old man who had committed 13 murders between 1974 and 1986, the New York Times remembers: What made the investigation possible was GEDmatch, a low-frills, online gathering place for people to upload DNA test results from popular direct-to-consumer services such as Ancestry or 23andMe, in hopes of connecting with unknown relatives. The authorities' decision to mine the genealogical enthusiasts' data for investigative leads was shocking at the time, and led the site to warn users. But the practice has continued, and has since been used in hundreds of cases.
But now using similar techniques, a wellness coach born in Mississippi (through a Facebook group called DNA Detectives) has helped over 200 strangers identify their unknown parents, the Times reports.

And she's recently donated more than $100,000 to a genetics lab called Othram — to fund the sequencing of DNA to solve cold cases back in her home state. "These families have waited so long for answers," she told the New York Times, which calls her "part of a growing cohort of amateur DNA detectives..." [Othram] created a site called DNASolves to tell the stories of horrific crimes and tragic John and Jane Does — with catchy names like "Christmas tree lady" and "angel baby" — to encourage people to fund budget-crunched police departments, so that they can hire Othram. A competitor, Parabon NanoLabs, had created a similar site called JusticeDrive, which has raised around $30,000.

In addition to money, Othram encouraged supporters to donate their DNA, a request that some critics called unseemly, saying donors should contribute to databases easily available to all investigators. "Some people are too nervous to put their DNA in a general database," said Mr. Mittelman, who declined to say how large his database is. "Ours is purpose-built for law enforcement."
Another group raising money for genetic investigations are the producers of true-crime podcasts — and their listeners. According to the article, the podcast-producing company Audiochuck has donated roughly $800,000 to organizations doing investigative genealogical research (including Othram), though the majority went to a nonprofit started by the host of the "Crime Junkie" podcast. (And that nonprofit raised another $250,000, some through crowdfunding.)

"Why just listen to a murder podcast when you can help police comb through genealogical databases for the second cousins of suspected killers and their unidentified victims?" the Times asks? So far donors around the country have given at least a million dollars to the cause. They could usher in a world where few crimes go unsolved — but only if society is willing to accept, and fund, DNA dragnets.... A group of well-off friends calling themselves the Vegas Justice League has given Othram $45,000, resulting in the solving of three murder-rape cases in Las Vegas, including those of two teenage girls killed in 1979 and in 1989.... [T]he perpetrators were dead....

Natalie Ram, a law professor at the University of Maryland, expressed concern about "the public picking and choosing between cases," saying investigative priorities could be determined by who can donate the most. Ms. Ram said the "largest share" of cases solved so far with the method "tend to involve white female victims...."

Ms. Ram is also concerned about the constitutional privacy issues raised by the searches, particularly for those people who haven't taken DNA tests or uploaded their results to the public internet. Even if you resolve never to put your DNA on a site accessible to law enforcement authorities, you share DNA with many other people so could still be discoverable. All it takes is your sibling, aunt or even a distant cousin deciding differently.

In 1983 the annual revenue at the electronics chain Crazy Eddie was roughly $134 million (or about $372 million today), remembers The Hustle. The next year they'd sold $44 million just in computers and games — and eventually grew to 43 stores. The company's stock ticker symbol was CRZY.

"There was just one major problem," the article notes. "Crazy Eddie had been lying about its numbers since its inception — and the higher the stock soared the further founder Eddie Antar went to maintain the illusion."

It's a colorful story from the early days of home PC sales. Antar's uncle hid up to $3.5 million in cash in a false ceiling at Antar's father's house, according to The Hustle. "Eddie Antar kept close tabs, usually calling his uncle twice a day to see how much money they were skimming.... The skimming strategy allowed Antar to not only hoard cash but also evade sales taxes. His employees were also paid off the books so Crazy Eddie could avoid payroll taxes." "Money was always in the house," said Debbie Rosen Antar, Antar's first wife, to investigators in the late 1980s. "And if I needed it and I asked him, he would say, 'Go underneath the bed and take what you need....'"

Why would a company built on a family fraud go public? Somebody told Antar he could keep making millions skimming cash, but he could make tens of millions if the company traded on the stock market. Strangely, Crazy Eddie's fraudulent history gave it an advantage. To provide the illusion of quickly increasing profits ahead of the IPO, the Antars simply reduced the amount of cash they were skimming. With millions more on the ledger instead of in the family's pockets, the company's profits looked more impressive.

As a public company, Crazy Eddie then made up for its inability to skim cash by initiating new fraud streams.

- The company embellished its inventories by millions of dollars to appear better-stocked and better positioned for profits.

- The Antar family laundered profits it had previously skimmed — and deposited in foreign bank accounts — back into the company to inflate revenues....

In November 1987, a hostile investment group led by Houston entrepreneur Elias Zinn pounced, purchasing Crazy Eddie. As Antar's cousin later recounted, Antar thought the sale would at least give them an opportunity to pin the fraud on the new owners. But Zinn immediately discovered $45 million of listed inventory was missing. Stores soon closed, and the company went bankrupt in 1989.
Two disgruntled ex-employees then brought fraud allegations to America's stock-regulating agency, the article reports, while the FBI "started sniffing around, too." Crazy Eddie fled the country, using forged passports to escape to Tel Aviv, Zurich, São Paulo, and the Cayman Islands. But he was eventually arrested in Israel, sentenced to 12.5 years in prison, and ordered to repay investors $121 million (though he apparently served only seven).

But Crazy Eddie also became a cultural phenomenon -- sort of. In the 1984 movie Splash, Darryl Hannah's character even watches a Crazy Eddie TV ad. The Hustle's article also includes photos of a Crazy Eddie stock certificate — and an actual "Wanted" poster issued the next year by the U.S. Marshalls office.

Yet just four years before his death in 2016, Antar — a high school dropout — was telling an interviewer from The Record that "I changed the business...."

In January the virally-popular game Wordle was sold to the New York Times for between between $1 million (£758,345) and $5 million. Now the Independent reveals why the game's creator took that step.

"Because so many people were cloning it and making money from it without his permission." Josh Wardle, a Welsh software engineer who now lives in Brooklyn, New York, said in a talk on Thursday that selling to the Times was "a way to walk away" from the pressure he felt to stop his creation being exploited.... The game's success inspired numerous smartphone apps that simply copied Mr Wardle's version while adding ads, in-app-purchases, or subscription fees, many of which were later removed from Apple's app store.

Speaking at the Game Developers Conference in San Francisco, Mr Wardle said: "That isn't money that I would have made, because I said I don't want to make money, but something about that felt really deeply unpleasant for me. And so selling to the New York Times was a way for me to walk away from that. I didn't want to be paying a lawyer to issue cease and desists on the game that I'm not making money from. It felt like it was all going to get really, really complicated in a way that just [made me] pretty stressed out, truthfully."

Answering a question from The Independent after the talk, Mr Wardle added that he felt "an enormous amount of pressure" and a sense of limited time to act because so many people were trying to copy the game.
Besides the outright clones, Wordle has also led to some interesting variations, including Nerdle (which challenges players to guess the digits and symbols in an eight-digit equation).

There's Dordle (which challenges players to guess two words at the same time), as well as a four-word variation called Quordle, and even an eight-word version called Octordle.

In a recent article in Tom's Guide (titled "I don't like Wordle — but I love these alternatives") they also recommended Heardle and Framed. "The former tasks you with guessing a song based on a short audio clip, and the latter asks you to name a movie based on a single frame." (As well as Adverswordle, where you choose the word while an AI tries to guess it.)

And then there's the excruciatingly difficult Semantle...

The non-profit Creative Commons (founded by Lawrence Lessig) opposes a new anti-piracy bill that "proposes to have the US Copyright Office mandate that all websites accepting user-uploaded material implement technologies to automatically filter that content." We've long believed that these kinds of mandates are overbroad, speech-limiting, and bad for both creators and reusers. (We're joined in this view by others such as Techdirt, Public Knowledge, and EFF, who have already stated their opposition.)

But one part of this attempt stands out to us: the list of "myths" Sen. Tillis released to accompany the bill. In particular, Tillis lists the concern that it is a "filtering mandate that will chill free speech and harm users" as a myth instead of a true danger to free expression-and he cites the existence of CC's metadata as support for his position.

Creative Commons is strongly opposed to mandatory content filtering measures. And we particularly object to having our work and our name used to imply support for a measure that undermines free expression which CC seeks to protect....

Limitations and exceptions are a crucial feature of a copyright system that truly serves the public, and filter mandates fail to respect them. Because of this, licensing metadata should not be used as a mandatory upload filter-and especially not CC license data. We do not support or endorse the measures in this bill, and we object to having our name used to imply otherwise.

The U.S. placed internet-security provider AO Kaspersky Lab on a list of companies deemed a threat to national security, for the first time adding a Russian entity to a list dominated by Chinese telecommunications firms. Bloomberg reports: The Federal Communications Commission on Friday also added China Telecom (Americas) Corp, and China Mobile International USA Inc. to the list. Once a company is on the list, federal subsidies can't be used to purchase its equipment or services. The action is part of the FCC's efforts to "strengthen America's communications networks against national security threats," Jessica Rosenworcel, the agency's chairwoman, said in a news release.

Kaspersky is a well known provider of anti-virus software, and has conducted investigations into a range of nation-state hacking incidents. It calls itself the world's largest privately-owned cybersecurity company on its website. It says it protects over 400 million users and 240,000 companies. [...] For Friday's update of the list, the FCC said it relied on findings by the Department of Homeland Security and an executive branch interagency body called the Committee for the Assessment of Foreign Participation in the United States Telecommunications Services Sector.

An anonymous reader writes: The operator of YouTube rippers FLVTO.biz and 2conv.com has announced that he will appeal the piracy verdict, where the RIAA won $83 million in damages. According to his attorneys, the legal process has gone off the rails, as the music companies didn't have to prove a single instance of copyright infringement. More context on the verdict, from TorrentFreak: Last October, the RIAA secured a major victory in its piracy lawsuit against YouTube-rippers FLVTO.biz and 2conv.com and their Russian operator Tofig Kurbanov. A Virginia federal court issued a default judgment in favor of several prominent music companies after the defendant walked away from the lawsuit. According to the order, there is a clear need to deter the behavior of Kurbanov who failed to hand over evidence including server logs. "A less drastic sanction is unlikely to salvage this case," the judge wrote.

Following this win, the RIAA asked for an injunction to stop the sites' worldwide stream-ripping activities. In addition, the music group demanded nearly $83 million in damages. Both of these requests were taken up in a report and recommendation issued by Magistrate Judge Buchanan last December. "Defendant's Websites caused the Plaintiffs to lose profits and streaming revenue because of the enormous internet traffic to and use of the Websites' stream-ripping functions," Judge Buchanan wrote. Mr. Kurbanov's legal team opposed this recommendation, arguing that the music companies failed to provide evidence that any infringing activity actually took place in the United States. Also, if the court believes that damages are appropriate, they should be substantially lower. The RIAA predictably disagreed and asked the court to stay the course and take over the recommendation. After weighing the positions from both sides, that's exactly what happened.

Former Microsoft Senior Director Yasser Elabd is working with whistleblowing agency Lioness to share information about kickbacks and bribery in the Middle East and North Africa. From a report: In June 2019, former Microsoft Senior Director Yasser Elabd traveled to Washington, D.C., to meet with members of the Securities and Exchange Commission, the Federal Bureau of Investigation and the U.S. Attorney General's office to discuss his allegations that Microsoft was ignoring bribery at subsidiaries in the Middle East and Africa. The meetings lasted nearly the entire day. Federal agents asked Elabd questions for hours. Elabd's attorney told him that it was one of the first times they had witnessed the AG's office send a representative to a whistleblower meeting like his.

But more than a year later, the SEC still hadn't made a decision about Elabd's allegations. The agency kept promising him that the team in charge of his case would make a decision soon about whether they would bring charges against Microsoft. Finally, at the beginning of March 2022, the case agent in charge of Elabd's whistleblowing report told his lawyer that the SEC was closing the case because it didn't have the resources to conduct interviews and find documentation abroad during the coronavirus pandemic. So Elabd decided to try a different route to share what he knows. Today he published an essay on the whistleblowing website Lioness that accuses Microsoft of firing him after two decades with the company because he asked questions about what he saw as bribery within the contracting services Microsoft uses to sell software to government and public bodies in countries in the Middle East and Africa.

The European Union agreed on Thursday to one of the world's most far-reaching laws to address the power of the biggest tech companies (Warning: source may be paywalled; alternative source), potentially reshaping app stores, online advertising, e-commerce, messaging services and other everyday digital tools. The New York Times reports: The law, called the Digital Markets Act, is the most sweeping piece of digital policy since the bloc put the world's toughest rules to protect people's online data into effect in 2018. The legislation is aimed at stopping the largest tech platforms from using their interlocking services and considerable resources to box in users and squash emerging rivals, creating room for new entrants and fostering more competition. [...] The Digital Markets Act will apply to so-called gatekeeper platforms, which are defined by factors including a market value of more than 75 billion euros, or about $83 billion. The group includes Alphabet, the owner of Google and YouTube; Amazon; Apple; Microsoft; and Meta. Specifics of the law read like a wish list for rivals of the biggest companies. Apple and Google, which make the operating systems that run on nearly every smartphone, would be required to loosen their grip. Apple will have to allow alternatives to its App Store for downloading apps, a change the company has warned could harm security. The law will also let companies such as Spotify and Epic Games use payment methods other than Apple's in the App Store, which charges a 30 percent commission.

Amazon will be barred from using data collected from outside sellers on its services so that it could offer competing products, a practice that is the subject of a separate E.U. antitrust investigation. The law will result in major changes for messaging apps. WhatsApp, which is owned by Meta, could be required to offer a way for users of rival services like Signal or Telegram to send and receive messages to somebody using WhatsApp. Those rival services would have the option to make their products interoperable with WhatsApp. The largest sellers of online advertising, Meta and Google, will see new limits for offering targeted ads without consent. Such ads -- based on data collected from people as they move between YouTube and Google Search, or Instagram and Facebook -- are immensely lucrative for both companies.

[...] With these actions, Europe is cementing its leadership as the most assertive regulator of tech companies such as Apple, Google, Amazon, Meta and Microsoft. European standards are often adopted worldwide, and the latest legislation further raises the bar by potentially bringing the companies under new era of oversight -- just like health care, transportation and banking industries. "Faced with big online platforms behaving like they were 'too big to care,' Europe has put its foot down," said Thierry Breton, one of the top digital officials in the European Commission. "We are putting an end to the so-called Wild West dominating our information space. A new framework that can become a reference for democracies worldwide." On Thursday, representatives from the European Parliament and European Council hammered out the last specifics of the law in Brussels. The agreement followed about 16 months of talks -- a speedy pace for the E.U. bureaucracy -- and sets the stage for a final vote in Parliament and among representatives from the 27 countries in the union. That approval is viewed as a formality.

An anonymous reader quotes a report from TechCrunch: Police in the United Kingdom have arrested seven people over suspected connections to the Lapsus$ hacking group, which has in recent weeks targeted tech giants including Samsung, Nvidia, Microsoft and Okta. In a statement given to TechCrunch, Detective Inspector Michael O'Sullivan from the City of London Police said: "The City of London Police has been conducting an investigation with its partners into members of a hacking group. Seven people between the ages of 16 and 21 have been arrested in connection with this investigation and have all been released under investigation. Our enquiries remain ongoing."

News of the arrests comes just hours after a Bloomberg report revealed a teenager based in Oxford, U.K. is suspected of being the mastermind of the now-prolific Lapsus$ hacking group. Four researchers investigating the gang's recent hacks said they believed the 16-year-old, who uses the online moniker "White" or "Breachbase," was a leading figure in Lapsus$, and Bloomberg was able to track down the suspected hacker after his personal information was leaked online by rival hackers. TechCrunch has seen a copy of the the suspected hacker's leaked personal information, which we are not sharing -- but it matches Bloomberg's reporting. City of London Police, which primarily focuses on financial crimes, did not say if the 16-year-old was among those arrested.

At least one member of Lapsus$ was also apparently involved with a recent data breach at Electronic Arts, according to [security reporter Brian Krebs], and another is suspected to be a teenager residing in Brazil. The latter is said to be so capable of hacking that researchers first believed that the activity they were witnessing was automated. Researchers' ability to track the suspected Lapsus$ members may be because the group, which now has more than 45,000 subscribers to its Telegram channel where it frequently recruits insiders and leaks victims' data, does little to cover its tracks. In a blog post this week, Microsoft said the group uses brazen tactics to gain initial access to a target organization, which has included publicly recruiting company insiders. As reported by Bloomberg this week, the group has even gone as far as to join the Zoom calls of companies they've breached and taunted employees trying to clean up their hack.

Come July, the EPA plans to retire the archive containing old news releases, policy changes, regulatory actions, and more. The Verge reports: The archive was never built to be a permanent repository of content, and maintaining the outdated site was no longer "cost effective," the EPA said to The Verge in an emailed statement. The EPA announced the retirement early this year, after finishing an overhaul of its main website in 2021, but says that the decision was years in the making. The agency maintains that it's abiding by federal rules for records management and that not all webpages qualify as official records that need to be preserved.

The EPA says it plans to migrate much of the information to other places. Old news releases will go to the current EPA website's page for press releases. When it comes to the rest of the content, the EPA has a process for making case-by-case decisions on what content can be deleted -- and what is relevant enough to move to the modern website. Some content might be deemed important enough to join the National Archives. The public will be able to request that content through the Freedom of Information Act.

The archive is the only comprehensive way that public information about agency policies, like fact sheets breaking down the impact of environmental legislation, and actions, like how the agency implements those laws, have been preserved, [says Gretchen Gehrke, one of the cofounders of a group called Environmental Data and Governance Initiative (EDGI) that's fighting for public access to resources like the EPA's online archives]. That makes the archive vital for understanding how regulation and enforcement have changed over the years. It also shows how the agency's understanding of an issue, like climate change, has evolved. And when the Trump administration deleted information about climate change on the EPA's website, much of it could still be found on the archive. Besides that, Gehrke says the content should just be available on principle because it's public information, paid for by taxpayer dollars.

"A bipartisan proposal in both the House and Senate would sharply limit the ability to seize emails without notice to the owner," writes longtime Slashdot reader hawk. "It places a six-month limit on the length of gag orders in warrants." The Hill reports: The Government Surveillance Transparency Act, sponsored by a bipartisan group of lawmakers from both chambers, puts limitations on gag orders that seek to block tech companies from altering users whose data has been seized. It targets a practice brought into the spotlight after journalists from CNN, The New York Times and The Washington Post all had their records seized by the Department of Justice (DOJ). The bill requires law enforcement agencies to notify surveillance subjects that their email, location and web browsing data has been seized, aligning with current practices for phone records and bank data.

"When the government obtains someone's emails or other digital information, users have a right to know," Sen. Ron Wyden (D-Ore.) said in a release. "Our bill ensures that no investigation will be compromised, but makes sure the government can't hide surveillance forever by misusing sealing and gag orders to prevent the American people from understanding the enormous scale of government surveillance, as well as ensuring that the targets eventually learn their personal information has been searched."

An anonymous reader quotes a report from Bloomberg: Cybersecurity researchers investigating a string of hacks against technology companies, including Microsoft and Nvidia, have traced the attacks to a 16-year-old living at his mother's house near Oxford, England. Four researchers investigating the hacking group Lapsus$, on behalf of companies that were attacked, said they believe the teenager is the mastermind.

The teen is suspected by the researchers of being behind some of the major hacks carried out by Lapsus$, but they haven't been able to conclusively tie him to every hack Lapsus$ has claimed. The cyber researchers have used forensic evidence from the hacks as well as publicly available information to tie the teen to the hacking group. Bloomberg News isn't naming the alleged hacker, who goes by the online alias "White" and "breachbase," who is a minor and hasn't been publicly accused by law enforcement of any wrongdoing. Another member of Lapsus$ is suspected to be a teenager residing in Brazil, according to the investigators. One person investigating the group said security researchers have identified seven unique accounts associated with the hacking group, indicating that there are likely others involved in the group's operations. The teen is so skilled at hacking — and so fast-- that researchers initially thought the activity they were observing was automated, another person involved in the research said. [...]

The teenage hacker in England has had his personal information, including his address and information about his parents, posted online by rival hackers. At an address listed in the leaked materials as the teen's home near Oxford, a woman who identified herself as the boy's mother talked with a Bloomberg reporter for about 10 minutes through a doorbell intercom system. The home is a modest terraced house on a quiet side street about five miles from Oxford University. The woman said she was unaware of the allegations against her son or the leaked materials. She said she was disturbed that videos and pictures of her home and the teen's father's home were included. The mother said the teenager lives at that address and had been harassed by others, but many of the other leaked details couldn't be confirmed. She declined to discuss her son in any way or make him available for an interview, and said the issue was a matter for law enforcement and that she was contacting the police.

The US Department of Justice and 14 state attorneys general yesterday asked a federal judge to sanction Google for misusing attorney-client privilege to hide emails from litigation. From a report: "In a program called 'Communicate with Care,' Google trains and directs employees to add an attorney, a privilege label, and a generic 'request' for counsel's advice to shield sensitive business communications, regardless of whether any legal advice is actually needed or sought.

Often, knowing the game, the in-house counsel included in these Communicate-with-Care emails does not respond at all," the DOJ told the court. The fact that attorneys often don't reply to the emails "underscor[es] that these communications are not genuine requests for legal advice but rather an effort to hide potential evidence," the DOJ said. The DOJ made its argument in a motion to sanction Google "and compel disclosure of documents unjustifiably claimed by Google as attorney-client privileged" and in a memorandum in support of the motion. "The Communicate-with-Care program had no purpose except to mislead anyone who might seek the documents in an investigation, discovery, or ensuing dispute," the DOJ alleged.

Google's Messages and Dialer apps for Android devices have been collecting and sending data to Google without specific notice and consent, and without offering the opportunity to opt-out, potentially in violation of Europe's data protection law. From a report: According to a research paper, "What Data Do The Google Dialer and Messages Apps On Android Send to Google?" [PDF], by Trinity College Dublin computer science professor Douglas Leith, Google Messages (for text messaging) and Google Dialer (for phone calls) have been sending data about user communications to the Google Play Services Clearcut logger service and to Google's Firebase Analytics service.

"The data sent by Google Messages includes a hash of the message text, allowing linking of sender and receiver in a message exchange," the paper says. "The data sent by Google Dialer includes the call time and duration, again allowing linking of the two handsets engaged in a phone call. Phone numbers are also sent to Google." The timing and duration of other user interactions with these apps has also been transmitted to Google. And Google offers no way to opt-out of this data collection. [...] Both pre-installed versions of these apps, the paper observes, lack app-specific privacy policies that explain what data gets collected -- something Google requires from third-party developers. And when a request was made through Google Takeout for the Google Account data associated with the apps used for testing, the data Google provided did not include the telemetry data observed.