An anonymous reader quotes Ars Technica: The now-unemployed owner of a shuttered ROM distribution site has been ordered to pay $2.1 million in damages to Nintendo after trying and failing to defend himself in the case.

In September 2019, Nintendo filed a lawsuit against Los Angeles resident Matthew Storman over his operation of RomUniverse.com, which offered prominent downloads of "Nintendo Switch Scene Roms" and other copyrighted game files. At the time, Nintendo said that the site had been "among the most visited and notorious online hubs for pirated Nintendo video games" for "over a decade." Storman has admitted that, in 2019, the site made up the bulk of his $30,000 to $36,000 a year in income. This included direct revenue from the sale of "premium unlimited accounts" for $30 per year that provided users with faster downloads and no limits.

By the time Storman signed a September 2020 agreement with Nintendo to shut the site down, he said he was deriving $800 a month from the site. According to court documents, Storman's income is now derived primarily from "unemployment and food stamps."

In a motion for dismissal, Storman invoked the "safe harbor" protections of the Digital Millennium Copyright Act (DMCA), arguing that he was just a neutral service provider for users sharing files. He also pointed out that he had agreed to Nintendo's DMCA takedown requests in the past. During a deposition, though, Nintendo got Storman to admit that he had uploaded Nintendo's copyrighted ROM files himself, obliterating any attempts at a "safe harbor" claim...

While Nintendo originally claimed that RomUniverse was responsible for "hundreds of thousands" of copyrighted downloads, that number was lowered to 50,000 based on evidence gleaned from screenshots of the site. Nintendo argued that each download cost it between $20 and $60 (the average cost of new games it sells) and that it had therefore lost between $1 and $3 million in revenue.

The EFF's senior staff attorney and their legal intern are warning that a bad copyright decision by a district court judge could lead many Americans to lose their internet access.

"In going after ISPs for the actions of just a few of their users, Sony Music, other major record labels, and music publishing companies have found a way to cut people off of the internet based on mere accusations of copyright infringement." When these music companies sued Cox Communications, an ISP, the court got the law wrong. It effectively decided that the only way for an ISP to avoid being liable for infringement by its users is to terminate a household or business's account after a small number of accusations — perhaps only two. The court also allowed a damages formula that can lead to nearly unlimited damages, with no relationship to any actual harm suffered.

If not overturned, this decision will lead to an untold number of people losing vital internet access as ISPs start to cut off more and more customers to avoid massive damages...

The district court agreed with Sony that Cox is responsible when its subscribers — home and business internet users — infringe the copyright in music recordings by sharing them on peer-to-peer networks. It effectively found that Cox didn't terminate accounts of supposedly infringing subscribers aggressively enough. An earlier lawsuit found that Cox wasn't protected by the Digital Millennium Copyright Act's (DMCA) safe harbor provisions that protect certain internet intermediaries, including ISPs, if they comply with the DMCA's requirements. One of those requirements is implementing a policy of terminating "subscribers and account holders... who are repeat infringers" in "appropriate circumstances." The court ruled in that earlier case that Cox didn't terminate enough customers who had been accused of infringement by the music companies.

In this case, the same court found that Cox was on the hook for the copyright infringement of its customers and upheld the jury verdict of $1 billion in damages — by far the largest amount ever awarded in a copyright case.

The District Court got the law wrong... An ISP can be contributorily liable if it knew that a customer infringed on someone else's copyright but didn't take "simple measures" available to it to stop further infringement. Judge O'Grady's jury instructions wrongly implied that because Cox didn't terminate infringing users' accounts, it failed to take "simple measures." But the law doesn't require ISPs to terminate accounts to avoid liability. The district court improperly imported a termination requirement from the DMCA's safe harbor provision (which was already knocked out earlier in the case). In fact, the steps Cox took short of termination actually stopped most copyright infringement — a fact the district court simply ignored.

The district court also got it wrong on vicarious liability... [T]he court decided that because Cox could terminate accounts accused of copyright infringement, it had the ability to supervise those accounts. But that's not how other courts have ruled. For example, the Ninth Circuit decided in 2019 that Zillow was not responsible when some of its users uploaded copyrighted photos to real estate listings, even though Zillow could have terminated those users' accounts. In reality, ISPs don't supervise the Internet activity of their users. That would require a level of surveillance and control that users won't tolerate, and that EFF fights against every day.

The consequence of getting the law wrong on secondary liability here, combined with the $1 billion damage award, is that ISPs will terminate accounts more frequently to avoid massive damages, and cut many more people off from the internet than is necessary to actually address copyright infringement...
They also argue that the termination of accounts is "overly harsh in the case of most copyright infringers" — especially in a country where millions have only one choice for broadband internet access. "Being effectively cut off from society when an ISP terminates your account is excessive, given the actual costs of non-commercial copyright infringement to large corporations like Sony Music." It's clear that Judge O'Grady misunderstood the impact of losing Internet access. In a hearing on Cox's earlier infringement case in 2015, he called concerns about losing access "completely hysterical," and compared them to "my son complaining when I took his electronics away when he watched YouTube videos instead of doing homework."

Slashdot reader Charlotte Web summarizes a Department of Justice press release: The U.S. Department of Justice says "millions" of computers around the world were infected with the Trickbot malware, which was used "to harvest banking credentials and deliver ransomware."

In February they arrested a 55-year-old woman in Miami, Florida, saying she and her associates "are accused of infecting tens of millions of computers worldwide, in an effort to steal financial information to ultimately siphon off millions of dollars through compromised computer systems," according to Special Agent in Charge Eric B. Smith of the FBI's Cleveland Field Office. In October ZDNet was calling Trickbot "one of today's largest malware botnets and cybercrime operations."

Yesterday that woman — Alla Witte, aka "Max" — was arraigned in federal court in Cleveland, Ohio. According to the indictment, Witte worked as a malware developer for the Trickbot Group and wrote code related to the control, deployment, and payments of ransomware.

From the Department of Justice announcement:

The ransomware informed victims that their computer was encrypted, and that they would need to purchase special software through a Bitcoin address controlled by the Trickbot Group to decrypt their files. In addition, Witte allegedly provided code to the Trickbot Group that monitored and tracked authorized users of the malware and developed tools and protocols to store stolen login credentials... Witte and her co-conspirators allegedly worked together to infect victim computers with the Trickbot malware designed to capture online banking login credentials and harvest other personal information, including credit card numbers, emails, passwords, dates of birth, social security numbers and addresses. Witte and others also allegedly captured login credentials and other stolen personal information to gain access to online bank accounts, execute unauthorized electronic funds transfers and launder the money through U.S. and foreign beneficiary accounts...

If convicted, Witte faces a maximum penalty of 30 years in prison for conspiracy to commit wire and bank fraud; 30 years in prison for each substantive bank fraud count; a two-year mandatory sentence for each aggravated identity theft count, which must be served consecutively to any other sentence; and 20 years in prison for conspiracy to commit money laundering.

The indictment alleges that "beginning in November 2015, Witte and others stole money and confidential information from unsuspecting victims, including businesses and their financial institutions in the United States, United Kingdom, Australia, Belgium, Canada, Germany, India, Italy, Mexico, Spain, and Russia through the use of the Trickbot malware." The AP reports the group is now accused of targeting high-reward victims which included hospitals, schools, public utilities, and governments, as well as real estate and law firms and country clubs.

Interestingly, this case is part of the U.S. Department of Justice's "Ransomware and Digital Extortion Task Force," with its Criminal Division working with the U.S. Attorneys' Offices and prioritizing the disruption, investigation, and prosecution of ransomware "by tracking and dismantling the development and deployment of malware, identifying the cybercriminals responsible, and holding those individuals accountable for their crimes," according to the department's statement. "The department, through the Task Force, also strategically targets the ransomware criminal ecosystem as a whole and collaborates with domestic and foreign government agencies as well as private sector partners to combat this significant criminal threat."

"These charges serve as a warning to would-be cybercriminals," said Deputy Attorney General Lisa O. Monaco, "that the Department of Justice, through the Ransomware and Digital Extortion Task Force and alongside our partners, will use all the tools at our disposal to disrupt the cybercriminal ecosystem."

"It is now written in the annals of legal history that Disney's Star Wars sequels, specifically The Last Jedi and The Rise of Skywalker, are mediocre," writes MovieWeb: This, according to Ninth Circuit Court Judge Kenneth K. Lee, who recently referred to the movies as such in a recent legal ruling... Judge Lee recently handed down a ruling in regards to a class action lawsuit against ConAgra Foods Inc. The case had to do with whether or not the company was responsible for placing a "100% Natural" label on bottles of Wesson Oil. ConAgra Foods no longer owns Wesson Oil.... And, as the judge found in his ruling, the company simply doesn't have the power to make that sort of call anymore....

This is where things get interesting. At this point in the ruling, Judge Lee decided to make a comparison, and that's where Star Wars comes in. It would seem the judge is a fan and he decided to liken the situation to Disney producing a trilogy of sequels after Lucasfilm was sold to them by George Lucas in 2012. And, in his professional, legal opinion, those movies were not up to snuff. "That is like George Lucas promising no more mediocre and schlocky Star Wars sequels shortly after selling the franchise to Disney. Such a promise would be illusory."

That wasn't the end of it either. In a footnote at the end of that page in the document, Judge Lee added some clarification saying, "As evident by Disney's production of The Last Jedi and The Rise of Skywalker."

UPDATE: America's Federal Bureau of Investigation has now "withdrawn a subpoena demanding records from USA TODAY that would identify readers of a February story about a southern Florida shootout that killed two agents and wounded three others," the newspaper reported today.

Friday USA Today had reported that it's "fighting a subpoena from the FBI demanding records that would identify readers of a February story" about a Southern Florida shooting that killed two of the investigative agency's agents and wounded three others.

Long-time Slashdot reader schwit1 shared their original report on Friday: In a motion filed in federal district court in Washington, D.C. asking a judge to quash the subpoena, Gannett, USA TODAY's parent company, said the effort is not only unconstitutional but also violates the Justice Department's own rules... The subpoena, issued in April, demands the production of records containing IP addresses and other identifying information "for computers and other electronic devices" that accessed the story during a 35-minute time frame starting at 8:03 p.m. on the day of the shooting.

"Being forced to tell the government who reads what on our websites is a clear violation of the First Amendment," Maribel Perez Wadsworth, USA TODAY's publisher, said in a statement. "The FBI's subpoena asks for private information about readers of our journalism...."

The subpoena, signed by an FBI agent in Maryland, said the records relate to a criminal investigation. But it's unclear how USA TODAY's readership records are related to the investigation of the Florida shooting, or why the FBI is focusing on the time frame. Wadsworth said Gannett's attorneys tried to contact the FBI before and after the company fought the subpoena in court, but she said the FBI has yet to provide any meaningful explanation of the basis for the subpoena.

The FBI and the Justice Department declined to comment.

CNBC reports that El Salvador "is looking to introduce legislation that will make it the world's first sovereign nation to adopt bitcoin as legal tender, alongside the U.S. dollar." In a video broadcast to Bitcoin 2021, a multiday conference in Miami being billed as the biggest bitcoin event in history, President Nayib Bukele announced El Salvador's partnership with digital wallet company, Strike, to build the country's modern financial infrastructure using bitcoin technology.

Strike founder and CEO Jack Mallers said this will go down as the "shot heard 'round the world for bitcoin...."

Speaking from the mainstage, Mallers said the move will help unleash the power and potential of bitcoin for everyday use cases on an open network that benefits individuals, businesses, and public sector services... While details are still forthcoming about how the rollout will work, CNBC is told that El Salvador has assembled a team of bitcoin leaders to help build a new financial ecosystem with bitcoin as the base layer. "It was an inevitability, but here already: the first country on track to make bitcoin legal tender," said Adam Back, CEO of Blockstream.

Slashdot reader DevNull127 writes: Documents filed by Florida's health department now "confirm two of the core aspects" of a whistleblower complaint filed by fired data manager Rebekah Jones, the Miami Herald reported Friday. "Sworn affidavits from Department of Health leaders acknowledge Jones' often-denied claim that she was told to remove data from public access after questions from the Miami Herald."

And they also report a position statement from the department (filed August 17th) acknowledging something even morning damning. While a team of epidemiologists at the Department of Health had developed data for the state's plan to re-open — their findings were never actually incorporated into that plan.

Reached for comment, a spokesperson for governor Ron DeSantis still insisted to the Herald that "every action taken by Governor DeSantis was data-driven and deliberate."
From the article: But when the Herald requested the data, data analysis, or data model related to reopening under Florida's open records law, the governor's office responded that there were no responsive records... Secrecy was a policy. Staffers were told not to put anything about the pandemic response into writing, according to four Department of Health employees who spoke on the condition of anonymity... Emails and texts reviewed by the Herald show the governor's office worked in coordination with Department of Health "executive leadership" to micromanage everything about the department's public response to the pandemic, from information requests from the press to specific wording and color choice on the Department of Health website and data dashboard. They slow-walked responses to questions on important data points and public records, initially withholding information and data on deaths and infections at nursing homes, state prisons and schools, forcing media organizations to file or threaten lawsuits. Important information that had previously been made public was redacted from medical examiner accounts of COVID-19 fatalities.

At one point the state mischaracterized the extent of Florida's testing backlog by over 50 percent — skewing the information about how many people were getting sick each day — by excluding data from private labs, a fact that was only disclosed in response to questions from the press. Emails show that amid questions about early community spread, data on Florida's earliest potential cases — which dated back to late December 2019 — were hidden from the public by changing "date range of data that was available on the dashboard."

Department of Health staffers interviewed by the Herald described a "hyper-politicized" communications department that often seemed to be trying to match the narrative coming from Washington.
The Herald's article also "delved into the details of the department's operation," writes DevNull127 : For example, the whistleblower complaint of Rebekah Jones quotes the state's deputy health secretary as telling her pointedly that "I once had a data person who said to me, 'you tell me what you want the numbers to be, and I'll make it happen.'"

Or, as Jones later described that interaction to her mother, "They want me to put misleading data up to support that dumb f***'s plan to reopen. And more people are gonna die because [of] this and that's not what I agreed to."

Last Friday the health department's Office of the Inspector General announced they'd found "reasonable cause" to open an investigation into decisions and actions by Department of Health leadership that could "represent an immediate injury to public health."
Meanwhile, Florida officials confirmed Friday night that their health department "will no longer update its Covid-19 dashboard and will suspend daily case and vaccine reports," according to the New York Times. "Officials will instead post weekly updates, becoming the first U.S. state to move to such an infrequent publishing schedule."

Jones had been using that data to continue running her own online dashboard, and posted Friday in lieu of data that the dashboard's operation would now be interrupted "as I work to reformat the website to adjust for these changes...." But she promised to keep trying to help the people of Florida "in whatever capacity I can with the limitations the Department of Health is now putting on public access to this vital health information."

After temporarily grounding its fleet of more than 500 DJI drones in January 2020 over cybersecurity concerns, the Pentagon has finally cleared two of DJI's drones of any security risks. An analysis of the two DJI drones built for government use found "no malicious code or intent" and are "recommended for use by government entities and forces working with US services," a report summary said. Pocketnow reports: Specifically, the Pentagon has cleared only two drone models so far -- the DJI Mavic Pro and Matrice 600 Pro. However, it will still come as a relief for the brand after being under the scanner for over security threats, especially after giants like HUAWEI have had to face terrible consequences after being blacklisted for similar reasons. DJI, on the other hand, has maintained that the company is not involved in any secretive data-sharing practices with the Chinese government and that its drones are safe to use.

"This U.S. government report is the strongest confirmation to date of what we, and independent security validations, have been saying for years -- DJI drones are safe and secure for government and enterprise operations," a DJI spokesperson was quoted as saying. While two of DJI's drone models can now be again used by the Interior Department, there is no relief for the company regarding its inclusion on the Commerce Department's Entity List. Even though the sale of its product has not been banned, sourcing technology from US-based firms would still require approval, and then there are risks of supply chain disruption as well as reputation loss.

An anonymous reader quotes a report from The Register: A scammer who convinced some of the world's biggest tech businesses to send him replacement kit has been sentenced to seven years and eight months in the U.S. prison system. Justin David May, 31, used stolen hardware serial numbers, a plethora of fake websites and online identities, social engineering tactics, and a network of associates, to scam Cisco out of nearly $3.5m in hardware in just 12 months. Microsoft lost 137 Surface laptops (retail cost $364,761) to the crew, with Lenovo US also losing 137 replacement hard drives worth $143,000 and APC (formerly American Power Conversion) getting scammed out of a few uninterruptible power supplies. May pled guilty to 42 counts of mail fraud, 10 counts of money laundering, three counts of interstate transportation of goods obtained by fraud, and two counts of tax evasion.

In the largest scam against Cisco, run from April 2016, according to court documents [PDF] filed in eastern district court of Pennsylvania, May and the team set up domains and email addresses to mimic cisco.com user IDs and harvested serial numbers of legit machinery. They then used these to trick Cisco into sending out replacement kit, such as a Cisco Catalyst 3850-48P-E Switch worth around $21,000 at the time, and a couple of Cisco ASR 9001 routers priced at over $100,000 for the pair. The same scam worked well for Microsoft and Lenovo too, it seems. The court docs note that May was skilled at picking imaginary faults that weren't remotely repairable, such as basic software issues, but which were more obvious as serious flaws needing a replacement unit. In addition the crew digitally altered images of their supposed kit and serial numbers to fool support staff. Once the hardware was received, usually via UPS or FedEx, the companies never got the faulty kit back because it never existed. Meanwhile the packages were picked up, sold on eBay and other second-hand sites, and the cash pocketed, or in the case of Microsoft, some of the hardware shipped to Singapore for resale.

The three major carriers in the U.S. have now agreed to start providing vertical location data for 911 calls, which will help first responders quickly locate 911 callers in multi-story buildings. XDA Developers reports: The FCC wrote in its announcement, "FCC Acting Chairwoman Jessica Rosenworcel today announced breakthrough agreements with America's three largest mobile phone providers to start delivering vertical location information in connection with 911 calls nationwide in the coming days. This information will help first responders quickly locate 911 callers in multi-story buildings, which will reduce response times and ultimately save lives."

The FCC first announced in 2015 that carriers would be required to start sharing vertical location data. The original deadline was June 2nd, 2021, but AT&T, T-Mobile, and Verizon wanted an 18-month extension (allegedly due to issues testing the functionality during the COVID-19 pandemic). With the deadline rapidly approaching, the FCC began an investigation in April to find out what was taking carriers so long. All three major carriers have now agreed to start providing vertical location data to 911 call centers within the next seven days, and each company will pay a $100,000 settlement. The agreement also increases the scope of the vertical location data; instead of the data only being provided in select areas, vertical location information will be provided by carriers across the entire United States. However, it will likely take longer than a week for the vertical data to be used in most 9-1-1 call centers, as the change will require updated software and (possibly) additional training for emergency dispatchers.

An anonymous reader writes: Data mining startup Stealth Data is working to help websites uncover the "individual names, phone numbers, emails and physical addresses" of the users who visit websites. This information "can include a website visitor's job title, employer, annual income, age, and personal and professional social media profiles" so that businesses can use this data for marketing purposes.

Stealth Data's third co-founder Chad Sneed experienced marketing frustrations firsthand through his family's dealership, Dennis Sneed Ford in Gower, Missouri. Sneed, who's a vice president and partner, said the dealership spends a significant amount on marketing, from search engines to third-party advertising. A bulk of the dealership's website visitors were anonymous, however, which meant it couldn't follow-up with visitors to try and close a sale. Sneed wanted to unlock that information and started talking to the dealership's outside marketing firm, Phame Influence, to see if it was possible. Puckett, who co-founded Phame with Paris, also is a trial lawyer.

"My lawyer hat instantly says no," Puckett said.

But after digging further, he discovered it's legal and that using the information for cold calling and emailing is fair game.

Co-founder Chad Sneed noted that he doesn't see any privacy issues.

Amazon's massive cloud-computing unit is aggressively recruiting U.S. government officials as it pushes to make itself essential to branches such as the military and the intelligence community, POLITICO reported Friday. From the report: Since 2018, Amazon Web Services has hired at least 66 former government officials with acquisition, procurement or technology adoption experience, most hired directly away from government posts and more than half of them from the Defense Department. That's a small portion of AWS' tens of thousands of employees, but a particularly key group to its federal business. Other AWS hires have come from departments including Homeland Security, Justice, Treasury and Veterans Affairs.

That's on top of more than 600 hires of government officials across all of Amazon during the same time -- itself a mark of the company's expanding footprint in the D.C. region. Amazon employs more than 1 million people overall, after adding 500,000 new jobs last year alone. The hiring spree highlights how tech companies are becoming more entrenched in the operations of the government itself -- and indispensable to Cabinet agencies and national security operations -- even as politicians shout about the danger of letting them get too powerful.

A California man has filed for a class action lawsuit against PC manufacturer Dell, claiming that the company "intentionally misled and deceived" buyers of its Alienware Area 51-m R1 gaming laptop, which was advertised to be more upgradeable than other gaming notebooks. From a report: The plaintiff, Robert Felter, who is based in San Francisco, alleges that Dell misleads customers to believe that the laptop would be upgradeable, possibly into future generations of components. The case, Felter v. Dell Technologies, Inc. (3:21-cv-04187) has been filed with the United States District Court in the Northern District of California. The Alienware Area 51-m was announced at CES 2019 and launched soon after. (The complaint claims the announcement was made in the summer of 2019, which is incorrect.). Among the Area 51-m's biggest touted innovations were a user-replaceable CPU and GPU.

At media briefings, Alienware representatives told the press that the CPU could be upgraded as long as it used Intel's Z390 chipset. The laptop used Intel's 9th Gen Core desktop processors, up to the Intel Core i9-9900K. Dell developed separate proprietary Dell Graphics Form Factor (DGFF) modules for the Nvidia graphics. The lawsuit, however, claims that consumers were told that "core components" (meaning the CPU and GPU) could be replaced beyond the current generation of hardware. "Dell's advertisement to the public didn't place any restrictions on the upgradeability of the laptop," lawyer David W. Kani said in an email to Tom's Hardware. "They also never disclosed that those with the highest spec CPU and/or GPU that their device would not be upgradeable."

An anonymous reader quotes a report from TechCrunch: A change to TikTok's U.S. privacy policy on Wednesday introduced a new section that says the social video app "may collect biometric identifiers and biometric information" from its users' content. This includes things like "faceprints and voiceprints," the policy explained. Reached for comment, TikTok could not confirm what product developments necessitated the addition of biometric data to its list of disclosures about the information it automatically collects from users, but said it would ask for consent in the case such data collection practices began. The biometric data collection details were introduced in the newly added section, "Image and Audio Information," found under the heading of "Information we collect automatically" in the policy. This is the part of TikTok's Privacy Policy that lists the types of data the app gathers from users, which was already fairly extensive.

The first part of the new section explains that TikTok may collect information about the images and audio that are in users' content, "such as identifying the objects and scenery that appear, the existence and location within an image of face and body features and attributes, the nature of the audio, and the text of the words spoken in your User Content." The policy also notes this part of the data collection is for enabling "special video effects, for content moderation, for demographic classification, for content and ad recommendations, and for other non-personally-identifying operations," it says. The more concerning part of the new section references a plan to collect biometric data. It states: "We may collect biometric identifiers and biometric information as defined under US laws, such as faceprints and voiceprints, from your User Content. Where required by law, we will seek any required permissions from you prior to any such collection." "The statement itself is vague, as it doesn't specify whether it's considering federal law, states laws, or both," adds TechCrunch. "It also doesn't explain, as the other part did, why TikTok needs this data. It doesn't define the terms 'faceprints' or 'voiceprints.' Nor does it explain how it would go about seeking the 'required permissions' from users, or if it would look to either state or federal laws to guide that process of gaining consent."

Brian Krebs: Fake, positive reviews have infiltrated nearly every corner of life online these days, confusing consumers while offering an unwelcome advantage to fraudsters and sub-par products everywhere. Happily, identifying and tracking these fake reviewer accounts is often the easiest way to spot scams. Here's the story of how bogus reviews on a counterfeit Microsoft Authenticator browser extension exposed dozens of other extensions that siphoned personal and financial data.

After hearing from a reader about a phony Microsoft Authenticator extension that appeared on the Google Chrome Store, KrebsOnSecurity began looking at the profile of the account that created it. There were a total of five reviews on the extension before it was removed: Three Google users gave it one star, warning people to stay far away from it; but two of the reviewers awarded it between three and four stars. "It's great!," the Google account Theresa Duncan enthused, improbably. "I've only had very occasional issues with it." "Very convenient and handing," assessed Anna Jones, incomprehensibly.

Apple said it's adjusting its approach to its AirTags sensors, changing the time they play an alert when separated from their owner, and also creating new ways to warn people an unexpected AirTag or Find My network-enabled device is nearby. From a report: The tech giant said Thursday it's begun sending out updates to its AirTags, changing the window of time they'll make noises when potentially being used to track another person. Initially, the Apple device would play in three days. Now it'll begin to play at a random time inside a window that lasts between 8 and 24 hours. To further reassure people about its AirTags, Apple said it's developing an app for Android devices that will help people "detect" an AirTag or Find My network-enabled device that may also be unsuspectedly "traveling" with them. Apple iPhones already have a similar alert system built into their devices. The Android app will be released later this year.

The United States Supreme Court has ruled today in a 6-3 vote to overturn a hacking-related conviction for a Georgia police officer, and by doing so, it also narrowed down the scope of the US' primary hacking law, the Computer Fraud and Abuse Act. From a report: The ruling, No. 19-783, comes in the Van Buren v. United States case of Nathan Van Buren, a former police sergeant in Cumming, Georgia, who was sentenced to 18 months in prison in May 2018 for taking a bribe of $5,000 to look up a license plate for a woman one of his informants met at a local strip club. Prosecutors charged Van Buren under the CFAA and argued that even if the police officer had been authorized to access the police database as part of his work duties, he "exceeded authorized access" when he performed a search against department internal policies. In subsequent appeals, Van Buren argued that the "exceeds authorized access" language in the CFAA was too broad and requested that the US Supreme Court rule on the matter, in a case the court decided to pick up and heard arguments last year.

Amazon.com's Ring, long criticized for a cozy relationship with law enforcement, will start requiring the police to publicly request home security footage captured by the company's doorbells and cameras. From a report: Beginning next week, police departments that want Ring users to help with investigations will be required to make the requests in the company's Neighbors app. Previously, police officers emailed users in a dedicated portal. Ring, the leading maker of internet-connected doorbells, has put cameras on the front of millions of homes, selling residents peace of mind via smartphone. But for civil liberties groups, the cameras -- and their use by law enforcement agencies -- pose threats to Americans' privacy and civil rights. Ring has shown no signs of abandoning its relationship with the police, but in recent years has grown more transparent, publicly identifying law enforcement partners and, as of next week, letting all Neighbors users see what information is being requested.

It's going to get harder for Android apps to track users who've opted out of receiving personalized ads, the Financial Times reports, after Google announced changes to how it'll handle the unique device identifiers that allow marketers to track them between apps. From a report: Starting later this year, Google is cutting off access to these "Advertising IDs" after a user opts out, and will show developers a "string of zeros" in its place. The news was announced in an email to Play Store developers, and Google has also updated its support page for Advertising IDs with the announcement. Google told developers the changes will "provide users with more control over their data, and help bolster security and privacy," the Financial Times reports. The change comes a few short months after Apple overhauled how advertising IDs work on iOS in an apparent attempt to compete with the new policy.

An anonymous reader quotes a report from the Electronic Frontier Foundation: Larry Brandt, a long-time supporter of internet freedom, used his nearly 20-year-old PayPal account to put his money where his mouth is. His primary use of the payment system was to fund servers to run Tor nodes, routing internet traffic in order to safeguard privacy and avoid country-level censorship. Now Brandt's PayPal account has been shut down, leaving many questions unanswered and showing how financial censorship can hurt the cause of internet freedom around the world.

Brandt first discovered his PayPal account was restricted in March of 2021. Brandt reported to EFF: "I tried to make a payment to the hosting company for my server lease in Finland. My account wouldn't work. I went to my PayPal info page which displayed a large vertical banner announcing my permanent ban. They didn't attempt to inform me via email or phone -- just the banner." Brandt was unable to get the issue resolved directly through PayPal, and so he then reached out to EFF. [...] We found no evidence of wrongdoing that would warrant shutting down his account, and we communicated our concerns to PayPal. Given that the overwhelming majority of transactions on Brandt's account were payments for servers running Tor nodes, EFF is deeply concerned that Brandt's account was targeted for shut down specifically as a result of his activities supporting Tor.

We reached out to PayPal for clarification, to urge them to reinstate Brandt's account, and to educate them about Tor and its value in promoting freedom and privacy globally. PayPal denied that the shutdown was related to the concerns about Tor, claiming only that "the situation has been determined appropriately" and refusing to offer a specific explanation. After several weeks, PayPal has still refused to reinstate Brandt's account. [...] EFF is calling on PayPal to do better by its customers, and that starts by embracing the Santa Clara principles [which attempt to guide companies in centering human rights in their decisions to ban users or take down content]. Specifically, we are calling on them to: publish a transparency report, provide meaningful notice to users, and adopt a meaningful appeal process. The Tor Project said in an email: "This is the first time we have heard about financial persecution for defending internet freedom in the Tor community. We're very concerned about PayPal's lack of transparency, and we urge them to reinstate this user's account. Running relays for the Tor network is a daily activity for thousands of volunteers and relay associations around the world. Without them, there is no Tor -- and without Tor, millions of users would not have access to the uncensored internet."

Brandt says he's not backing down and is still committed to supporting the Tor network to pay for servers around the world using alternative means. "Tor is of critical importance for anyone requiring anonymity of location or person," says Brandt. "I'm talking about millions of people in China, Iran, Syria, Belarus, etc. that wish to communicate outside their country but have prohibitions against such activities. We need more incentives to add to the Tor project, not fewer."