Government

Proposing an Alternative To Renting or Owning a House: Publicly-Owned Housing (theatlantic.com) 318

"Renting is terrible. Owning is worse. A third option is necessary," argues a recent article in the Atlantic, "a way to rent without making someone else rich."

It's written by Shane Phillips, who's the Housing Inititiative Project Manager at UCLA's Lewis Center for Regional Policy Studies: Largely as a consequence of housing prices, Generation X held less than half as much wealth in 2019 as Baby Boomers of the same age did two decades earlier, and Millennials are on course to hold even less. Something has gone catastrophically wrong, and the problem won't be solved by doubling down on homeownership; we've seen where that leads. But our current model of renting — a lifetime of uncertainty only to make someone else rich — won't do the job either. We need something new, an innovation on par with the government's development of 30-year mortgages nearly a century ago. We need a housing option that combines the accessibility, flexibility, and limited risk of renting with some of the stability and wealth-generating potential of homeownership.
His suggested solutiion? A public-ownership rental option: The foundation of the program would be quite simple: public ownership of housing, acquired or built with government loans — though run by local for-profit or nonprofit property managers — and rented at market prices. No saving for a down payment (or being given one by family) and no qualifying for a mortgage. The only requirements for participation in the public-ownership option would be (1) move in, and (2) pay rent.

As the loans were paid down, the equity would accrue to the tenants, minus the cost of operating and maintaining the building, administrative costs, and so on. Unlike rent-to-own programs, however, this option would never require that the tenant take out a mortgage. A renter would never truly "own" her unit. But she would claim a stake in the public portfolio of properties and be able to draw on that asset, perhaps in the form of monthly payments after a few years of renting, or larger dividends later in life, much like Social Security. The benefit could be transferred to any publicly owned apartment, allowing tenants to build wealth without being locked in place. After 35 or 40 years, a tenant might no longer owe any rent at all...

Renting in a public-ownership building would be an option for the large number of middle-income individuals who lack the resources or the immediate desire to become homeowners.

Crime

How a True-Crime Podcast Led to an Arrest in a 25-Year-Old Cold Case (pressdemocrat.com) 41

"A true-crime podcast has been credited with providing valuable information in a missing person case from the 1990s after two men were arrested," reports Newsweek: Kristin Smart, 19, of Stockton, California, went missing in May 1996 after returning to her dorm at California Polytechnic State University campus in San Luis Obispo. The case received widespread attention from Chris Lambert's Your Own Backyard podcast dedicated to investigating Smart's disappearance, which he began in September 2019.

The last person who was thought to have seen Smart alive was Paul Flores, 44, who was also a freshman at the time, when he offered to walk Smart back to her dorm. Since Smart's disappearance, Flores has been a person of interest, suspect, and prime suspect. Now, District Attorney Dan Dow alleges that Flores killed her in his dorm room following an attempted rape. On Tuesday, April 13, Flores was arrested for her murder, and his father Ruben Flores, 80, was arrested as an accessory to murder for allegedly helping his son conceal Smart's body, which has never been found.

San Luis Obispo County Sheriff Ian Parkinson said that they arrested the father and son on Tuesday after a search at Ruben Flores' home using ground-penetrating radar and cadaver dogs last month resulted in new evidence linked to Smart's disappearance... Parkinson also credited the Your Own Backyard podcast with raising awareness of the case which resulted in "valuable information" after a key witness came forward.

The Associated Press calls it "the latest in a line of true-crime podcasts credited with producing results in court," noting investigations by the Up and Vanished podcast also "led a man to confess to killing a Georgia beauty queen."

And they list some of the "compelling clues" uncovered by the podcaster investigating Kristin Smart's disappearance: A former colleague of Paul Flores' mother, Susan Flores, told him Mrs. Flores came into work after Memorial Day weekend 1996 — when Smart went missing — saying she didn't sleep well because her husband had gotten a phone call in the middle of the night and left in his car. "The speculation has been all along that Paul called his dad in the middle of the night and his dad came up and helped him get rid of Kristin's body," Lambert said.

A tenant who lived for a year at Susan Flores' home told him she heard a watch alarm every morning at 4:20 a.m. Smart had worked as a lifeguard at 5 a.m. at the Cal Poly pool, so it's possible she set her watch to wake up at that early hour.

China

China and Huawei's Dystopian 'New IP' Plan for 6G (justsecurity.org) 241

Long-time Slashdot reader schwit1 shared this analysis from Just Security: Huawei's plans for 6G and beyond make U.S. concerns over 5G look paltry: Huawei is proposing a fundamental internet redesign, which it calls "New IP," designed to build "intrinsic security" into the web. Intrinsic security means that individuals must register to use the internet, and authorities can shut off an individual user's internet access at any time. In short, Huawei is looking to integrate China's "social credit," surveillance, and censorship regimes into the internet's architecture...

To avoid scrutiny of New IP's shortcomings, Huawei has circumvented international standards bodies where experts might challenge the technical shortcomings of the proposal. Instead, Huawei has worked through the United Nations' International Telecommunications Union (ITU), where Beijing holds more political sway...

Huawei dominance on New IP and 6G would not only create a less free, less interoperable internet, it would pave the way for authoritarian governments to gain expanded say over future changes to the internet for years to come.

Facebook

Report: Facebook Loophole 'Lets World Leaders Deceive and Harass Their Citizens' (theguardian.com) 39

"Facebook has repeatedly allowed world leaders and politicians to use its platform to deceive the public or harass opponents despite being alerted to evidence of the wrongdoing," reports the Guardian: The Guardian has seen extensive internal documentation showing how Facebook handled more than 30 cases across 25 countries of politically manipulative behavior that was proactively detected by company staff.

The investigation shows how Facebook has allowed major abuses of its platform in poor, small and non-western countries in order to prioritize addressing abuses that attract media attention or affect the US and other wealthy countries. The company acted quickly to address political manipulation affecting countries such as the US, Taiwan, South Korea and Poland, while moving slowly or not at all on cases in Afghanistan, Iraq, Mongolia, Mexico and much of Latin America.

"There is a lot of harm being done on Facebook that is not being responded to because it is not considered enough of a PR risk to Facebook," said Sophie Zhang, a former data scientist at Facebook who worked within the company's "integrity" organization to combat inauthentic behavior. "The cost isn't borne by Facebook. It's borne by the broader world as a whole."

United States

US Advocacy Group Launches Online Petition Demanding Protections for 'Right to Repair' (repair.org) 27

A U.S. advocacy group called The Repair Association is urging Americans to demand protections for their right to repair from the country's consumer protection agency.

"Tell the FTC: People just want to fix their stuff!" argues a page urging concerned U.S. citizens to sign an online petition (shared by long-time Slashdot reader Z00L00K).

The petition asks the FTC to...
  • Enforce the law against companies who use illegal tying arrangements to force consumers to purchase connected repair services.
  • Enforce the law against companies who violate the Magnuson Moss Warranty Act by voiding warranties when a consumer fixes something themselves or uses third-party parts or repair services.
  • Enforce the law against companies who refuse to sell replacement parts, diagnostic and repair tools, or service information to independent repair providers.
  • Publish new guidance on unfair, deceptive, and abusive terms in end user license agreements (EULAs) that: restrict independent or self repair; restrict access to parts and software; prohibit the transfer of user licenses; that and that purport to void warranties for independent or self repair.
  • Issue new rules prohibiting exclusivity arrangements with suppliers, customers, and repair providers that exclude independent repair providers and suppress competition in the market for repair services.
  • Issue new rules prohibiting companies from deceiving customers by selling products which cannot be repaired without destroying the device or cannot be repaired outside of the company's own service network, without disclosing that fact at the point of sale.

United States

The FBI Accessed and Repaired 'Hundreds' of Hacked Microsoft Exchange Servers (csoonline.com) 86

America's top law enforcement agency "obtained a court order that allowed it to remove a backdoor program from hundreds of private Microsoft Exchange servers that were hacked through zero-day vulnerabilities earlier this year," reports CSO. (Thanks to detritus. (Slashdot reader #46,421) for sharing the news...) Earlier this week, the Department of Justice announced that the FBI was granted a search and seizure warrant by a Texas court that allows the agency to copy and remove web shells from hundreds of on-premise Microsoft Exchange servers owned by private organizations. A web shell is a type of program that hackers install on hacked web servers to grant them backdoor access and remote command execution capabilities on those servers through a web-based interface.

In this case, the warrant targeted web shells installed by a cyberespionage group dubbed Hafnium that is believed to have ties to the Chinese government. In early March, Microsoft reported that Hafnium has been exploiting previously unpatched vulnerabilities in Microsoft Exchange to compromise servers. At the same time, the company released patches for those vulnerabilities, as well as indicators of compromise and other detection tools, but this didn't prevent other groups of attackers from exploiting the vulnerabilities after they became public. In its warrant application, dated April 13, the FBI argues that despite the public awareness campaigns by Microsoft, CISA and the FBI itself, many servers remained infected with the web shell deployed by Hafnium. While the exact number has been redacted from the unsealed warrant, the DOJ said in a press release that it was "hundreds."

The FBI asked for, and received court approval, to access the malicious web shells through the passwords set by the original attackers and then use that access against the malware itself by executing a command that will delete the web shell, which is essentially an .aspx script deployed on the server. The FBI was also allowed to make a copy of the web shells first because they could constitute evidence.

The warrant states that it "does not authorize the seizure of any tangible property" or the copying or alteration of any content from the servers aside from the web shell themselves, which are identified in the warrant by their unique file paths. This means the FBI was not granted permission to patch the vulnerabilities to protect the servers from future exploitation or to remove any additional malware or tools that hackers might have already deployed...

The FBI sent an email message from an official email account, including a copy of the warrant, to the email addresses associated with the domain names of the infected servers.

An official statement from the Department of Justice is already using the past tense, announcing that U.S. authorities "have executed a court-authorized operation to copy and remove malicious web shells from hundreds of vulnerable computers in the United States. They were running on-premises versions of Microsoft Exchange Server software used to provide enterprise-level email service."
IBM

Ex IBM Sales Manager, Fired After Battling Discrimination Against Subordinates, Wins $11 Million Lawsuit (theregister.com) 162

On Thursday, a federal jury in Seattle, Washington, found that former IBM sales manager Scott Kingston had been unlawfully fired by the company and denied sales commission after challenging the treatment of subordinates as racially biased. And it awarded him $11.1 million. The Register reports: The case dates back to 2017 when two IBM sales people within months of each other closed similarly large software sales deals that led to vastly different commission payments. Nick Donato, who is White, received more than $1m for a SAS Institute deal, while Jerome Beard, who is Black, was paid about $230,000 for closing a sale to HCL Technologies. Beard was paid about 15 per cent of what he should have received under his agreement with IBM, despite a company policy not to cap sales commissions.

Kingston, who managed the two salespeople through two lower-level managers, raised his concerns about racial discrimination with his superiors toward the end of 2017. Recalling his jury testimony, he said of his conversation with his managers, "They were telling me it wasn't about money; it was some other reason. I flat out said, 'You are leaving no possibility for anybody to conclude another reason than racial discrimination. You are foreclosing any other possible conclusion. You are going to get us sued.'" And that's what happened. Beard sued IBM in 2018. After a failed motion by IBM to dismiss the case in April, 2020, the company settled for an undisclosed sum several months later.

Kingston sued in 2019 [PDF], after IBM fired him in April, 2018, claiming he had erred in approving Donato's seven-figure commission. The company also fired two other IBM managers, Andre Temidis and Michael Lee, who raised similar objections to the allegedly discriminatory capping of commission due to an Arab-American salesperson. The Seattle jury found [PDF] IBM violated Washington State law against discrimination and policies against race discrimination and withholding wages.
"We are disappointed by the jury's verdict," IBM said in a statement emailed to The Register. "IBM does not condone retaliation, race discrimination, or any other form of discrimination. The company will consider all of its options on appeal."
Government

US House Committee Approves Blueprint For Big Tech Crackdown (reuters.com) 35

An anonymous reader quotes a report from The Associated Press: The U.S. House of Representatives Judiciary Committee formally approved a report accusing Big Tech companies of buying or crushing smaller firms, Representative David Cicilline's office said in a statement on Thursday. With the approval during a marathon, partisan hearing, the more than 400-page staff report will become an official committee report, and the blueprint for legislation to rein in the market power of the likes of Alphabet's Google, Apple, Amazon and Facebook. The report was approved by a 24-17 vote that split along party lines. The companies have denied any wrongdoing.

Suggested legislation in the report ranged from the aggressive, such as potentially barring companies like Amazon.com from operating the markets in which they also compete, to the less controversial, like increasing the budgets of the agencies that enforce antitrust law -- the Justice Department's Antitrust Division and the Federal Trade Commission. The report also urged Congress to allow antitrust enforcers more leeway in stopping companies from purchasing potential rivals, something that is now difficult.

Crime

A Tesla Helped Police Track Down a Hate Crime Suspect (gizmodo.com) 78

An anonymous reader quotes a report from Gizmodo: Throughout December, someone was setting fires at the Martin Luther King Jr. Community Presbyterian Church, a "predominately Black" congregation located in Springfield, Massachusetts. An FBI affidavit claims that the last of these fires, set on Dec. 28, "essentially destroyed" the building -- burning away large parts of the interior. During this period, the same person is suspected of having carried out a "series of tire-slashings" targeted at vehicles near or around the church -- a majority of which were owned by Black individuals. Now, 44-year-old Maine resident Dushko Vulchev has been arrested in connection to the crimes. He was charged in a federal court in Springfield on Thursday, a release from the U.S. Justice Department shows, and is potentially facing decades behind bars.

Court documents illustrate how state, local and federal authorities used a variety of surveillance footage and data collection to piece together Vulchev's whereabouts and place him at or near these crimes. In particular, the vandal slipped up when he allegedly slashed the tires of a Tesla located not far from the church. Authorities say one of the car's many pre-installed security cameras caught blatant images of the culprit as he damaged the tires, then later returned to steal them along with the vehicle's rims. "Based on my training and experience and this investigation, I am aware that the Tesla mentioned above is equipped with cameras at various points around the body," said the FBI agent who wrote the affidavit. "I have reviewed video footage retrieved from the Tesla showing an individual that I can identify as Vulchev...The video footage from the Tesla shows Vulchev at a close distance crouching near the Tesla and using a tire iron to remove the wheels." Using other data collected and a variety of local surveillance footage, law enforcement was able to build a case against Vulchev.

Privacy

Amazon Tried To Coerce Ecobee Into Collecting Private User Data, the WSJ Reports (theverge.com) 53

Amazon tried to use its power to coerce Ecobee into using its smart home products to collect user data by threatening Ecobee's ability to sell its products on Amazon, according to a report from The Wall Street Journal. The Verge reports: As of now, Ecobee's products can still be purchased on Amazon, but the WSJ claims that negotiations between Ecobee and Amazon are ongoing. According to the WSJ, the online retail giant asked Ecobee to share data from its Alexa-enabled smart thermostats, even when the customer wasn't actively using the voice assistant. Ecobee reportedly refused to have its devices constantly report back to Amazon about the state of the user's home, including data on which doors were locked or unlocked and the set temperature. The reasoning being that enabling its devices to report this data to Amazon would be a violation of its customer's trust.

Ecobee may have also been concerned that Amazon wanted the data to build competing products. The retail giant has a reputation for taking non-public sales data and using it to develop products -- something that's come up in antitrust investigations in the US and EU. Amazon has also been accused of using this sales data to directly copy and compete with other companies using its Amazon Basics brand.

Facebook

Ireland Opens GDPR Investigation Into Facebook Leak (techcrunch.com) 7

An anonymous reader quotes a report from TechCrunch: Facebook's lead data supervisor in the European Union has opened an investigation into whether the tech giant violated data protection rules vis-a-vis the leak of data reported earlier this month. Here's the Irish Data Protection Commission's statement:

"The Data Protection Commission (DPC) today launched an own-volition inquiry pursuant to section 110 of the Data Protection Act 2018 in relation to multiple international media reports, which highlighted that a collated dataset of Facebook user personal data had been made available on the internet. This dataset was reported to contain personal data relating to approximately 533 million Facebook users worldwide. The DPC engaged with Facebook Ireland in relation to this reported issue, raising queries in relation to GDPR compliance to which Facebook Ireland furnished a number of responses.

The DPC, having considered the information provided by Facebook Ireland regarding this matter to date, is of the opinion that one or more provisions of the GDPR and/or the Data Protection Act 2018 may have been, and/or are being, infringed in relation to Facebook Users' personal data. Accordingly, the Commission considers it appropriate to determine whether Facebook Ireland has complied with its obligations, as data controller, in connection with the processing of personal data of its users by means of the Facebook Search, Facebook Messenger Contact Importer and Instagram Contact Importer features of its service, or whether any provision(s) of the GDPR and/or the Data Protection Act 2018 have been, and/or are being, infringed by Facebook in this respect."
"We are cooperating fully with the IDPC in its enquiry, which relates to features that make it easier for people to find and connect with friends on our services," Facebook said in a statement. "These features are common to many apps and we look forward to explaining them and the protections we have put in place."
Privacy

EFF Partners With DuckDuckGo (eff.org) 42

The Electronic Frontier Foundation (EFF) today announced it has enhanced its groundbreaking HTTPS Everywhere browser extension by incorporating rulesets from DuckDuckGo Smarter Encryption. According to the digital rights group's press release, HTTPS Everywhere is "a collaboration with The Tor Project and a key component of EFF's effort to encrypt the web and make the Internet ecosystem safe for users and website owners." From the press release: "DuckDuckGo Smarter Encryption has a list of millions of HTTPS-encrypted websites, generated by continually crawling the web instead of through crowdsourcing, which will give HTTPS Everywhere users more coverage for secure browsing," said Alexis Hancock, EFF Director of Engineering and manager of HTTPS Everywhere and Certbot web encrypting projects. "We're thrilled to be partnering with DuckDuckGo as we see HTTPS become the default protocol on the net and contemplate HTTPS Everywhere's future."

EFF began building and maintaining a crowd-sourced list of encrypted HTTPS versions of websites for a free browser extension -- HTTPS Everywhere -- which automatically takes users to them. That keeps users' web searching, pages visited, and other private information encrypted and safe from trackers and data thieves that try to intercept and steal personal information in transit from their browser. [...] DuckDuckGo, a privacy-focused search engine, also joined the effort with Smarter Encryption to help users browse securely by detecting unencrypted, non-secure HTTP connections to websites and automatically upgrading them to encrypted connections. With more domain coverage in Smarter Encryption, HTTPS Everywhere users are provided even more protection. HTTPS Everywhere rulesets will continue to be hosted through this year, giving our partners who use them time to adjust. We will stop taking new requests for domains to be added at the end of May.

Patents

Apple Wins New Trial in $506 Million Patent-Damages Award (bloomberg.com) 10

A federal judge tossed a $506.2 million damages award against Apple after ruling the iPhone maker should have been able to argue that patent owner Optis Wireless Technology was making unfair royalty demands, though he refused to throw out the liability finding. From a report: Optis and its partners in the case, PanOptis Patent Management and Unwired Planet, claimed that Apple's smartphones, watches, and tablets that operate over the LTE cellular standard were using its patented technology. U.S. District Court Judge Rodney Gilstrap said the jury should have been allowed to consider whether the royalty demand was consistent with a requirement that standard-essential patents be licensed on "fair, reasonable and non-discriminatory," or FRAND, terms. The patent trial in August, one of the few held during the pandemic, was part of an unusual sweep of verdicts in Texas that collectively resulted in $3.7 billion in damages against tech companies like Apple and Intel Corp. Apple was also hit with damages awards of $502.8 million in a decade-long battle over security communications technology, and $308.5 million in a case over digital rights management.
Facebook

Singapore's Most Expensive Facebook Link (restofworld.org) 16

An anonymous reader shares a report: On November 7, 2018, Leong Sze Hian, a financial advisor and blogger, shared an article on his Facebook page, without comment. The article, published by Malaysian website The Coverage, alleged that Singapore's Prime Minister Lee Hsien Loong had become a target of ongoing investigations in the 1Malaysia Development Berhad scandal, a massive case of graft in Malaysia that drew in banks in Singapore, Hollywood stars, and Saudi royalty. The article claimed that Malaysia, under former Prime Minister Najib Razak, had signed unfair deals with Singapore in return for help to launder stolen funds. These were serious allegations, particularly in Singapore, where the government is ultra-sensitive to any suggestion of corruption.

The response, unsurprisingly, was strong and swift: the law and home affairs minister issued a clear rebuttal, Singapore's High Commission in Kuala Lumpur described the article as libelous, and the Monetary Authority of Singapore lodged a police report against the author of a similar article published in the States Times Review, a website run by a Singaporean in Australia who is highly critical of Singapore's ruling People's Action Party. The Infocomm Media Development Authority, Singapore's media regulator, told Leong to remove the link from his Facebook page; he did. But it was already too late to save him from trouble. Two days later, he found out that Prime Minister Lee was going to sue him for defamation. Last month, the High Court ruled that Leong did defame Lee and ordered him to pay almost $100,000 (133,000 Singapore dollars) in damages. It's an extraordinary sum for a simple Facebook link that stayed up for only three days. But there's a particular legal precedent in Singapore: public leaders are usually awarded higher damages when they win defamation suits related to their character or integrity. In his judgment, Justice Aedit Abdullah quoted a previous case in which the courts stated that public "leaders are generally entitled to higher damages also because of their standing in Singapore society and devotion to public service."

The Almighty Buck

Schwab Sues Former Client After Accidental Transfer of $1.2 Million (reuters.com) 198

An anonymous reader writes: Charles Schwab is suing one of its former customers after the retail brokerage allegedly sent more than $1.2 million to an account of the Louisiana woman and then could not get the money back. Schwab meant to send $82.56 to Kelyn Spadoni's Fidelity Brokerage Services account in February, but a computer glitch caused it to erroneously transfer more than $1.2 million, according to the lawsuit. Schwab tried to get the money back, but repeated calls and texts to Spadoni, who lives in a suburb of New Orleans, were not returned, the brokerage said in the lawsuit. "We are fully cooperating with authorities in an effort to resolve this issue," Schwab said in a statement on Tuesday. Fidelity declined comment. After receiving the money in her account, Spadoni transferred a quarter of the money to another account, after which she bought a house and a car using the funds, Jefferson Parish Sheriff's Office spokesman Captain Jason Rivarde said in an interview on Tuesday. "Obviously you are not planning to give the money back if you spent it," he said. When Spadoni signed up with Schwab in January, the agreement she signed included a section that said any overpayment of funds must be returned, said the lawsuit, filed March 30.
Censorship

China Launches Hotline To Report Online Comments That 'Distort' History or 'Deny' Its Cultural Excellence (variety.com) 124

An anonymous reader quotes a report from Variety: China's internet regulator has launched a hotline for citizens to report online comments that defame the ruling Communist Party and its approved description of history ahead of the Party's upcoming 100th anniversary. The new hotline will enable internet users to stop the spread of "mistaken opinions" and create a "good public opinion atmosphere" to pave the way for the July 1 occasion, the Cyberspace Administration of China (CAC) said in a notice. People can also send in tip-offs via the CAC's website and app.

"For a while now, some people with ulterior motiveshave spread historically nihilistic false statements online, maliciously distorting, slandering and denying Party, national and military history in an attempt to confuse people's thinking," the notice said. "We hope that most internet users will play an active role in supervising societyand enthusiastically report harmful information." "Historically nihilistic" information, in official rhetoric, is content that incites doubt about the Party's account of the past.

It will accept four types of content complaints: distortions of history, attacks on the Party's "leadership, guiding ideology, principles or policies," the defamation of heroes and martyrs, and "denials of the excellence of traditional Chinese culture, revolutionary culture and advanced socialist culture." The CAC notice did not explain what punishments would be in store for violators. China already frequently detains and jails people for online speech deemed politically inappropriate.

Iphone

How the FBI Managed To Get Into the San Bernardino Shooter's iPhone (theverge.com) 94

A new report from The Washington Post reveals how the FBI gained access to an iPhone linked to the 2015 San Bernardino shooting. Apple refused to build a backdoor into the phone, citing the potential to undermine the security of hundreds of millions of Apple users, which kicked off a legal battle that only ended after the FBI successfully hacked the phone. Thanks to the Washington Post's report, we now know the methods the FBI used to get into the iPhone. Mitchell Clark summarizes the key findings via The Verge: The phone at the center of the fight was seized after its owner, Syed Rizwan Farook, perpetrated an attack that killed 14 people. The FBI attempted to get into the phone but was unable to due to the iOS 9 feature that would erase the phone after a certain number of failed password attempts. Apple attempted to help the FBI in other ways but refused to build a passcode bypass system for the bureau, saying that such a backdoor would permanently decrease the security of its phones. After the FBI announced that it had gained access to the phone, there were concerns that Apple's security could have been deeply compromised. But according to The Washington Post, the exploit was simple: [An Australian security firm called Azimuth Security] basically found a way to guess the passcode as many times as it wanted without erasing the phone, allowing the bureau to get into the phone in a matter of hours.

The technical details of how the auto-erase feature was bypassed are fascinating. The actual hacking was reportedly done by two Azimuth employees who gained access to the phone by exploiting a vulnerability in an upstream software module written by Mozilla. That code was reportedly used by Apple in iPhones to enable the use of accessories with the Lightning port. Once the hackers gained initial access, they were able to chain together two more exploits, which gave them full control over the main processor, allowing them to run their own code. After they had this power, they were able to write and test software that guessed every passcode combination, ignoring any other systems that would lock out or erase the phone. The exploit chain, from Lightning port to processor control, was named Condor. As with many exploits, though, it didn't last long. Mozilla reportedly fixed the Lightning port exploit a month or two later as part of a standard update, which was then adopted by the companies using the code, including Apple.

The Internet

Washington State Votes To End Restriction On Community Broadband (vice.com) 42

An anonymous reader quotes a report from Motherboard: Washington State lawmakers have voted to kill telecom-industry backed restrictions that limit the reach of community broadband. The Public Broadband Act (HB1336) passed the state Senate with a 27-22 vote on Sunday, after passing the House with a vote of 60-37 last February. State Representative Drew Hansen applauded the bill's passage on Twitter, stating it "reverses decades of bad policy" and opens the door to better, cheaper broadband. "Washington was one of only 18 states that restricted local governments from serving the public by providing public broadband," Hansen told Motherboard. "My bill eliminates that restriction."

In Washington, a twenty-one year old law let some local governments build their own broadband networks, but prohibited local utilities from delivering broadband to customers directly. Hansen, who was also the primary sponsor of the state's new net neutrality law, says his bill finally eliminates those unnecessary limits entirely. "The Public Broadband Act broadly authorizes all local governments to provide broadband to anyone -- people who are totally unserved, people who have some internet access but it's not affordable or reliable -- any people at all," Hansen told Motherboard. "Under the Public Broadband Act, Washington governments have completely unrestricted authority to provide broadband to the public."

The Internet

FCC Urges Americans To Run Internet Speed App To Counter Broadband Data Fudging (theregister.com) 63

The FCC is encouraging netizens to use its internet speed mobile app in an effort to finally get accurate broadband data across the United States. The Register reports: In an announcement on Monday, the telecoms regulator noted that "the app provides a way for consumers to test the performance of their mobile and in-home broadband networks" and "provides the test results to the FCC." It stops far short of saying that the data will be used to make policy decisions, however, saying only that the figures gathered "will help to inform the FCC's efforts to collect more accurate and granular broadband deployment data."

The public push doesn't mean that things are going to get better soon. Big Cable has aggressively -- and successfully -- argued in the past that data provided by users over an app is not sufficiently robust to form the basis of governmental decisions. And so the FCC will have to use the results as a way to push for change rather than use the data to make direct decisions. Everybody, including numerous states, cities, congressfolk and the GAO, know that the official FCC data provided by ISPs is not worth the paper it's written on. But broader usage of the app should expose just how inaccurate official figures are, which should in turn provide enough impetus for change. The bigger question is whether enough progress is made in the next four years to make any difference.

AI

Detroit Man Sues Police For Wrongfully Arresting Him Based On Facial Recognition 92

A man who was falsely accused of shoplifting has sued the Detroit Police Department for arresting him based on an incorrect facial recognition match. The American Civil Liberties Union filed suit on behalf of Robert Williams, whom it calls the first US person wrongfully arrested based on facial recognition. The Verge reports: The Detroit Police Department arrested Williams in 2019 after examining security footage from a shoplifting incident. A detective used facial recognition technology on a grainy image from the video, and the system flagged Williams as a potential match based on a driver's license photo. But as the lawsuit notes, facial recognition is frequently inaccurate, particularly with Black subjects and a low-quality picture. The department then produced a photo lineup that included Williams' picture, showed it to a security guard who hadn't actually witnessed the shoplifting incident, and obtained a warrant when that guard picked him from the lineup.

Williams -- who had been driving home from work during the incident -- spent 30 hours in a detention center. The ACLU later filed a formal complaint on his behalf, and the prosecutor's office apologized, saying he could have the case expunged from his records. The ACLU claims Detroit police used facial recognition under circumstances that they should have known would produce unreliable results, then dishonestly failed to mention the system's shortcomings -- including a "woefully substandard" image and the known racial bias of recognition systems.

Slashdot Top Deals