Planned legislation to establish new business areas in Nevada would allow technology companies to effectively form separate local governments. From a report: Democratic Gov. Steve Sisolak announced a plan to launch so-called Innovation Zones in Nevada to jumpstart the state's economy by attracting technology firms, Las Vegas Review-Journal reported Wednesday. The zones would permit companies with large areas of land to form governments carrying the same authority as counties, including the ability to impose taxes, form school districts and courts and provide government services. The measure to further economic development with the "alternative form of local government" has not yet been introduced in the Legislature. Sisolak pitched the concept in his State of the State address delivered Jan. 19. The plan would bring in new businesses at the forefront of "groundbreaking technologies" without the use of tax abatements or other publicly funded incentive packages that previously helped Nevada attract companies like Tesla. Sisolak named Blockchains, LLC as a company that had committed to developing a "smart city" in an area east of Reno after the legislation has passed.

An anonymous reader quotes a report from Ars Technica: SolarWinds, the previously little-known company whose network-monitoring tool Orion was a primary vector for one of the most serious breaches in US history, has pushed out fixes for three severe vulnerabilities. Martin Rakhmanov, a researcher with Trustwave SpiderLabs, said in a blog post on Wednesday that he began analyzing SolarWinds products shortly after FireEye and Microsoft reported that hackers had taken control of SolarWinds' software development system and used it to distribute backdoored updates to Orion customers. It didn't take long for him to find three vulnerabilities, two in Orion and a third in a product known as the Serv-U FTP for Windows. There's no evidence any of the vulnerabilities have been exploited in the wild.

The most serious flaw allows unprivileged users to remotely execute code that takes complete control of the underlying operating system. Tracked as CVE-2021-25274 the vulnerability stems from Orion's use of the Microsoft Message Queue, a tool that has existed for more than 20 years but is no longer installed by default on Windows machines. [...] The second Orion vulnerability, tracked as CVE-2021-25275, is the result of Orion storing database credentials in an insecure manner. Specifically, Orion keeps the credentials in a file that's readable by unprivileged users. Rakhmanov facetiously called this "Database Credentials for Everyone." While the files cryptographically protect the passwords, the researcher was able to find code that converts the password to plaintext. The result: anyone who can log in to a box locally or through the Remote Desktop Protocol can gain the credentials for the SolarWindsOrionDatabaseUser.

The third vulnerability, tracked as CVE-2021-25276, resides in the Serv-U FTP for Windows. The program stores details for each account in a separate file. Those files can be created by any authenticated Windows user. Rakhmanov wrote: "Specifically, anyone who can log in locally or via Remote Desktop can just drop a file that defines a new user, and the Serv-U FTP will automatically pick it up. Next, since we can create any Serv-U FTP user, it makes sense to define an admin account by setting a simple field in the file and then set the home directory to the root of C:\ drive. Now we can log in via FTP and read or replace any file on the C:\ since the FTP server runs as LocalSystem." Fixes for Orion and Serv-U FTP are available here and here.

hcs_$reboot shares a report from The New York Times: Rupert Murdoch's Fox Corporation and three of its popular anchors are the targets of a $2.7 billion defamation lawsuit filed on Thursday by Smartmatic, a company that became a prominent subject of discredited theories about widespread fraud in the 2020 presidential election. Smartmatic, an election technology company, filed the suit in New York State Supreme Court against the Fox Corporation, Fox News, and the anchors Lou Dobbs, Maria Bartiromo and Jeanine Pirro. As part of the same action, the company is suing Rudolph W. Giuliani and Sidney Powell, who made the case for election fraud as guests on Fox programs while representing President Donald J. Trump.

In its 276-page complaint, Smartmatic argues that Mr. Giuliani and Ms. Powell "created a story about Smartmatic" and that "Fox joined the conspiracy to defame and disparage Smartmatic and its election technology and software." Smartmatic, which provided services for the 2020 election in only one county, filed its suit in the tense aftermath of a vote that Mr. Trump and his supporters have repeatedly and falsely described as rigged or stolen. Smartmatic is seeking damages of "no less than $2.7 billion," the complaint says, and is requesting a jury trial. In a statement to CNN, Powell said: "I have not received notice or a copy of this alleged lawsuit. However, your characterization of the claims shows that this is just another political maneuver motivated by the radical left that has no basis in fact or law."

Amazon drivers at some U.S. facilities will soon have an extra set of eyes watching them when they hit the road to make their daily deliveries. From a report: The company recently began testing AI-equipped cameras in vehicles to monitor contracted delivery drivers while they're on the job, with the aim of improving safety. Amazon has deployed the cameras in Amazon-branded cargo vans used by a handful of companies that are part of its delivery service partner program, which are largely responsible for last-mile deliveries. The cameras could be rolled out to additional DSPs over time, and Amazon has already distributed an instructional video to DSPs, informing them of how the cameras work. Deborah Bass, an Amazon spokesperson, confirmed to CNBC that the company has begun using the AI-equipped cameras across its delivery fleet. Some details of Amazon's plans were previously reported by The Information. "We are investing in safety across our operations and recently started rolling out industry leading camera-based safety technology across our delivery fleet," Bass said in a statement. "This technology will provide drivers real-time alerts to help them stay safe when they are on the road."

Several readers have shared this report: In what could be the nation's first such case, the city of San Francisco filed suit Wednesday against its own school district, demanding the restart of in-person instruction for more than 52,000 students. City Attorney Dennis Herrera named the San Francisco Board of Education, the San Francisco Unified School District and Superintendent Vincent Matthews as defendants in what the city says is an unprecedented legal fight between overlapping government agencies over how to reopen classes during the pandemic. Herrera said the board has had more than 10 months to develop a plan to get students back into classrooms and so far "they have earned an F." Students in districts just outside San Francisco and those enrolled in San Francisco private schools have all seen the inside of classrooms since the pandemic struck, unlike SFUSD pupils, the plaintiffs said. "Having a plan to make a plan doesn't cut it," the city attorney added.

While some major metropolitan areas operate public schools from City Hall, virtually all California K-12 campuses come under the authority of local districts that are autonomous from city and county governments. San Francisco City Hall and the San Francisco Unified School District, and its school board, operate independently of each other. "This is not the path we would have chosen, but nothing matters more right now than getting our kids back in school," Mayor London Breed said. "The city has offered resources and staff to get our school facilities ready and to support testing for our educators." Representatives for the National School Boards Association, an advocacy group for public schools and local boards of education, said they believe San Francisco's lawsuit is the first civil action filed by a city against a district over Covid-19 closings. "Reopening decisions are very, very difficult, but they call for collaboration, not litigation," association CEO Anna Maria Chavez said in a statement. "Everyone wants students back in schools as soon as it is safe, but it must be a community decision based on local data that involves all of the key players from teachers and administrators to parents and local health officials." Further reading: San Francisco Vs San Francisco School Board: A Push To Get Students Back In School.

In an effort to combat abuse on its platform, Pornhub said it's expanding its human moderation team, releasing an upcoming transparency report, and introducing biometric technology to verify users who upload videos. The announcement comes after the platform came under scrutiny in December for claims it hosted child sexual abuse material. As a result, Visa and Mastercard suspended services on the site indefinitely.

Some of the measures it took to address the issue at the time included banning all non-verified users from posting to the site and deleting all content uploaded from unverified sources -- which amounted to over 10 million videos being deleted, or more than 80 percent of all videos on the platform. Motherboard reports: Tuesday's statement says that verification will still be limited to people in Pornhub's Model Program, and verification will be done by Yoti, a digital identity verification company, "by providing a current photo and government-approved identification document." "Yoti will check the validity of the ID document and match the user's ID document to their photo using secure biometric technology," according to the statement.

Other portions of the expanded policies include details about how moderators will work going forward, including that they will "regularly monitor search terms within the platform for increases in phrasings that attempt to bypass the safeguards in place." Moderators will also be trained more rigorously, and offered support and therapy. "Content moderators will also undergo further exhaustive training to identify potentially illegal material and testing," Pornhub said. "If needed, content moderators have access to specialized support, including wellness benefits and therapeutic measures, to support them in their critical work."

In its statement, Pornhub also announced that it will release a transparency report "detailing its content moderation results from 2020, including the total number of reports filed with [the National Center for Missing & Exploited Children], as well as other key details related to the trust and safety of the platform." "Much like Facebook, Instagram, Twitter and other tech platforms, Pornhub seeks to be fully transparent about the content that should and should not appear on the platform," Pornhub said in the statement. "This report will be the first of its kind among adult content platforms, setting the standard for transparency and accountability in the industry."

An anonymous reader quotes a report from Bloomberg: The Centers for Disease Control may recommend wearing two masks -- one over the other -- to keep at bay the more contagious variants of the coronavirus, according to Anthony Fauci. The CDC and Fauci discussed the matter Monday but the agency doesn't yet have the data to make any formal recommendation, he said Tuesday during a Washington Post event. Still, "it makes common sense" to increase protection, Fauci said. The infectious disease expert has previously endorsed double-masking given the new strains of the virus.

All but two US states -- Montana and Wyoming -- now have police or fire departments participating in Amazon's Ring network, which lets law enforcement ask users for footage from their Ring security cameras to assist with investigations, the Financial Times reported. From a report: Figures from Ring show more than 1,189 departments joined the program in 2020 for a total of 2,014. That's up sharply from 703 departments in 2019 and just 40 in 2018. The FT reports that local law enforcement departments on the platform asked for Ring videos for a total of more than 22,335 incidents in 2020. The disclosure data from Ring also shows that law enforcement made some 1,900 requests -- such as subpoenas, search warrants, and court orders -- for footage or data from Ring cameras even after the device owner has denied the request. Amazon complied with such requests 57 percent of the time, its figures show, down from 68 percent in 2019.

The CEO of online stock brokerage Robinhood is expected to testify before a House committee on Feb. 18 as lawmakers dig into the firm's role in the tumultuous trading of GameStop stock and other companies, people familiar with the matter said. Politico reports: The hearing before the House Financial Services Committee with Robinhood CEO Vlad Tenev, which has not been formally announced, is primed to be a blockbuster. Share prices of GameStop and other struggling companies skyrocketed last week in part thanks to traders on the social media website Reddit targeting Wall Street hedge funds, which were betting heavily that the stock price would fall. Some of the investors betting against the companies subsequently suffered huge losses.
[...]
"I am concerned about whether or not Robinhood restricted the trading because there was collusion between Robinhood and some of the hedge funds that were involved with this," Waters said on MSNBC this weekend. It was not clear if Democrats would ask other financial institutions to testify. Democratic lawmakers are also examining the role of firms owned by billionaire Ken Griffin. The two companies -- the hedge fund Citadel and trading firm Citadel Securities -- denied responsibility for any broker's decision to suspend trading. Citadel bailed out a hedge fund that suffered from GameStop's stock increase and Citadel Securities pays Robinhood to execute its stock trades.

Facebook is testing a notification that notifies Apple iOS users about ways the tech giant uses their data to target personalized ads to them. Axios reports: The test is happening in light of upcoming changes to Apple's privacy settings that will make it harder for Facebook and others to collect data on Apple users for ad targeting. Facebook warned investors last week that changes to Apple's "Identifier for Advertisers" (IDFA) user tracking feature will likely impact its business. The feature asks Apple iOS users to opt-in to having their data collected, instead of asking them to opt-out. Developers forecast that only around 10-30% of users will actually opt-in to having their data collected, making it much harder for advertisers to target potential Apple customers without as much access to their data.

Details: In an updated blog post, Facebook says it will be showing their prompt "to ensure stability for the businesses and people who use our services." The prompt, which provides information about how Facebook uses personalized ads, will be shown to users globally on Facebook and Instagram. In the post, Facebook says that if users accept the prompts for Facebook and Instagram, the ads you see on those apps won't change. "If you decline, you will still see ads, but they will be less relevant to you." The tech giant notes that Apple has said that providing education about its new privacy changes is allowed.

AmiMoJo shares a report: Xiaomi has sued the U.S. Defense and Treasury departments, challenging a blacklisting that blocks American investors from buying the Chinese smartphone giant's securities. The lawsuit came after the Defense Department determined earlier this month that China's biggest smartphone maker was affiliated with the People's Liberation Army. Beijing-based Xiaomi called the blacklisting "unconstitutional" and seeks a court ruling to reverse the designation, which was made in the waning days of the Trump administration. "Xiaomi faces imminent, severe, and irreparable harm if the Designation remains in place and the restrictions take effect," the company said in the filing in the U.S. district court of Columbia. The lawsuit also named Defense Secretary Lloyd Austin and Treasury Secretary Janet Yellen as defendants. Under former President Donald Trump, the U.S. had targeted scores of Chinese tech companies citing national security. Huawei Technologies, one of the biggest rivals to Xiaomi in smartphone market, was cut off from its key suppliers as a result of a series of restrictions imposed by the former administration.

The Verge reports that SpaceX's first high-altitude test flight of its Starship rocket, "which launched successfully but exploded in a botched landing attempt in December, violated the terms of its Federal Aviation Administration test license, according to two people familiar with the incident." Both the landing explosion and license violation prompted a formal investigation by the FAA, driving regulators to put extra scrutiny on Elon Musk's hasty Mars rocket test campaign. The so-called mishap investigation was opened that week, focusing not only on the explosive landing but on SpaceX's refusal to stick to the terms of what the FAA authorized, the two people said. It was unclear what part of the test flight violated the FAA license, and an FAA spokesman declined to specify in a statement to The Verge.

"The FAA will continue to work with SpaceX to evaluate additional information provided by the company as part of its application to modify its launch license," FAA spokesman Steve Kulm said Friday. "While we recognize the importance of moving quickly to foster growth and innovation in commercial space, the FAA will not compromise its responsibility to protect public safety. We will approve the modification only after we are satisfied that SpaceX has taken the necessary steps to comply with regulatory requirements."

The heightened scrutiny from regulators after the launchpad spectacle has played a role in holding up SpaceX's latest "SN9" Starship test attempt, which the company said would happen on Thursday. The shiny steel alloy, 16-story-tall rocket was loaded with fuel and ready to fly. But at the time, FAA officials were still going through their license review process for the test because of several changes SpaceX made in its license application, a source said. Musk, frustrated with the process, took to Twitter.
"Unlike its aircraft division, which is fine, the FAA space division has a fundamentally broken regulatory structure," Musk tweeted on Thursday. "Their rules are meant for a handful of expendable launches per year from a few government facilities. Under those rules, humanity will never get to Mars."

The Verge also notes that Musk was asked by the Wall Street Journal what role government should play in regulating innovation just a few hours before Starship's test in December. Musk's reply? "A lot of the time, the best thing the government can do is just get out of the way."

"The South African Revenue Service (SARS) has released this week its own custom web browser," reports ZDNet, "for the sole purpose of re-enabling Adobe Flash Player support, rather than port its existing website from using Flash to HTML-based web forms." To prevent the app from continuing to be used in the real-world to the detriment of users and their security, Adobe began blocking Flash content from playing inside the app starting January 12, with the help of a time-bomb mechanism... As SARS tweeted on January 12, the agency was impacted by the time-bomb mechanism, and starting that day, the agency was unable to receive any tax filings via its web portal, where the upload forms were designed as Flash widgets. But despite having a three and a half years heads-up, SARS did not choose to port its Flash widgets to basic HTML & JS forms, a process that any web developer would describe as trivial. Instead, the South African government agency decided to take one of the most mind-blowing decisions in the history of bad IT decisions and release its own web browser.

Released on Monday on the agency's official website, the new SARS eFiling Browser is a stripped-down version of the Chromium browser that has two features.

The first is to re-enable Flash support. The second is to let users access the SARS eFiling website.

As Chris Peterson, a software engineer at Mozilla, pointed out, the SARS browser only lets users access the official SARS website, which somewhat reduces the risk of users getting their systems infected via Flash exploits while navigating the web. But as others have also pointed out, this does nothing for accessibility, as the browser is only available for Windows users and not for other operating systems such as macOS, Linux, and mobile users, all of which are still unable to file taxes.

"Huawei, the crown jewel of China's technology industry, has suffered from a sustained American campaign to keep its equipment from being used in new 5G networks around the world," reports the New York Times. Now they've identified "a covert pro-Huawei influence campaign in Belgium about 5G networks." [Alternate URL here]

It began when trade lawyer Edwin Vermulst was paid to write an article criticizing a Belgian policy that would block Huawei from lucrative contracts: First, at least 14 Twitter accounts posing as telecommunications experts, writers and academics shared articles by Mr. Vermulst and many others attacking draft Belgium legislation that would limit "high risk" vendors like Huawei from building the country's 5G system, according to Graphika, a research firm that studies misinformation and fake social media accounts. The pro-Huawei accounts used computer-generated profile pictures, a telltale sign of inauthentic activity. Next, Huawei officials retweeted the fake accounts, giving the articles even wider reach to policymakers, journalists and business leaders. Kevin Liu, Huawei's president for public affairs and communications in Western Europe, who has a verified Twitter account with 1.1 million followers, shared 60 posts from the fake accounts over three weeks in December, according to Graphika. Huawei's official account in Europe, with more than five million followers, did so 47 times...

Twitter said it had removed the fake accounts after Graphika alerted it to the campaign on Dec. 30... Many of their followers appeared to be bots...

The effort suggests a new twist in social media manipulation, said Ben Nimmo, a Graphika investigator who helped identify the pro-Huawei campaign. Tactics once used mainly for government objectives — like Russia's interference in the 2016 American presidential election — are being adapted to achieve corporate goals. "It's business rather than politics," Mr. Nimmo said. "It's not one country targeting another country. It looks like an operation to promote a major multinational's interests — and to do it against a European state."
Though the social media campaign had little impact on Belgian policymakers, one telecom consultancy noted Huawei's fear that similar legislation "could spread to other parts of the world." (The article points out Belgium is the headquarters of both NATO and the European Union.)

But Phil Howard, the director of the Oxford Internet Institute, see a future where disinformation will become increasingly commercialized. "The flow of money is increasingly there," he tells the Times. "Large-scale social media influence operations are now part of the communications tool kit for any large global corporation."

Slashdot reader DevNull127 writes: This week a security researcher discovered a bot on Telegram that sold the phone numbers of Facebook users for $20 apiece. "The security researcher who found this vulnerability, Alon Gal, says that the person who runs the bot claims to have the information of 533 million users, which came from a Facebook vulnerability that was patched in 2019," reported the Verge. Motherboard reported the bot was also offering "bulk" pricing, selling 10,000 phone numbers for $5,000.

Telegram told the New York Post that they'd blocked the bot Tuesday morning, while Facebook downplayed the incident, reminding the Post "This is old data." But the Post notes that Facebook already had more than 1.6 billion daily active users in September 2019, and security researcher Alon Gal posted a count of the millions of affected users in each country, finding 32,315,282 in America, 11,522,328 in the United Kingdom, 7,320,478 in Australia, and 3,494,385 in Canada.

But the Verge points out the most ominous message of the breach: that ""the data is still out there on the web" — and that it's already resurfaced, more than once, in the days since it was initially scraped.

"The same legalese that can ban Donald Trump from Twitter can bar users from joining class-action lawsuits," warns the official Editorial Board of the New York Times, urging "It's time to fix the fine print." [Alternate URL here] [M]ost people have no idea what is signed away when they click "agree" to binding terms of service contracts — again and again on phones, laptops, tablets, watches, e-readers and televisions. Agreeing often means allowing personal data to be resold or waiving the right to sue or join a class-action lawsuit... Because corporations and their lawyers know most consumers don't have the time or wherewithal to study their new terms, which can stretch to 20,000 words — about the length of Shakespeare's "Julius Caesar" — they stuff them with opaque provisions and lengthy legalistic explanations meant to confuse or obfuscate. Understanding a typical company's terms, according to one study, requires 14 years of education, which is beyond the level most Americans attain. A 2012 Carnegie Mellon study found that the average American would have to devote 76 work days just to read over tech companies' policies. That number would probably be much higher today.

At its core, the arrangement is unbalanced, putting the burden on consumers to read through voluminous, nonnegotiable documents, written to benefit corporations in exchange for access to their services. It's hard to imagine, by contrast, being asked to sign a 60-page printed contract before entering a bowling alley or a florist shop... Though courts have held terms of service contracts to be binding, there is generally no legal requirement that companies make them comprehensible. It is understandable, then, that companies may feel emboldened to insert terms that advantage them at their customers' expense.

That includes provisions that most consumers wouldn't knowingly agree to: an inability to delete one's own account, granting companies the right to claim credit for or alter their creative work, letting companies retain content even after a user deletes it, letting them gain access to a user's full browsing history and giving them blanket indemnity. More often than not, there is a clause (including for The New York Times's website) that the terms can be updated at any time without prior notice. Some terms approach the absurd. Food and ride-share companies, like DoorDash and Lyft, ask users to agree that the companies are not delivery or transportation businesses, a sleight of hand designed to give the companies license to treat their contract drivers as employees while also sheltering the companies from liability for whatever may happen on a ride or delivery. Handy, an on-demand housecleaning service, once sought in its terms of service to put customers on the hook for future tax liabilities should their contract workers' job classification be changed to employee...

"This is one of the tools used by corporations to assert themselves over their customers and whittle away their rights," said Nancy Kim, a California Western School of Law professor who studies online contracts. "With their constant updates to terms and conditions, it amounts to a massive bait-and-switch...."

"We have become so beaten down by this that we just accept it," said Woodrow Hartzog, a Northeastern University law professor. "The idea that anyone should be expected to read these terms of service is preposterous — they are written to discourage people from reading them...."
The Board urges the U.S. Congress to consider requiring greater transparency about terms and their changes — as well as simpler explanations. "If a company's online service is open to 13-year-olds, as many are, then the terms of use need to be written so an eighth grader can understand them."

A nonprofit watchdog news site in Tulsa, Oklahoma reports: The Oklahoma Attorney General's Office has been tasked with attempting to return a $2 million stockpile of a malaria drug once touted by former President Donald Trump as a way to treat the coronavirus. In April, Gov. Kevin Stitt, who ordered the hydroxychloroquine purchase, defended it by saying that while it may not be a useful treatment for the coronavirus, the drug had multiple other uses and "that money will not have gone to waste in any respect."

But nearly a year later the state is trying to offload the drug back to its original supplier, California-based FFF Enterprises, Inc, a private pharmaceutical wholesaler...

It's unclear yet how much of the initial $2 million investment in the hydroxychloroquine the state could recoup.
"While governments in at least 20 other states obtained more than 30 million doses of the drug through donations from the federal reserve or private companies, Oklahoma and Utah bought them from private pharmaceutical companies," notes ABC News: Then-Utah Gov. Gary Herbert, a Republican, initially defended the state's $800,000 purchase of 20,000 packets of hydroxychloroquine compounded with zinc, but later canceled an additional plan to spend $8 million more to buy 200,000 more treatments. The state then managed to secure a refund on the $800,000 no-bid contract it signed with a local pharmacy company that had been promoting the drugs.

The CEO of the pharmacy company has since pleaded guilty to a federal misdemeanor for mislabeling the drug imported from China.

sciencehabit shares a report from Science Magazine: President Joe Biden today created a task force that will conduct a 120-day review of scientific integrity policies across the U.S. government, including documenting instances in which "improper political interference" interfered with research or led to the suppression or distortion of data. The review is part of a lengthy memorandum from Biden on his plans for "restoring trust" in government by emphasizing scientific integrity and the use of evidence in policymaking. The memo also calls on federal research agencies to name Chief Scientific Officers, and for all agencies to spend 90 days reviewing the role of dozens of panels that provide scientific advice to government. Agencies will also determine if they want to recreate technical advisory panels dismantled under former President Donald Trump.

"Scientific and technological information, data, and evidence are central to the development and iterative improvement of sound policies," states the memo. "Improper political interference in the work of Federal scientists or other scientists who support the work of the Federal Government and in the communication of scientific facts undermines the welfare of the Nation." Today's memo largely restates policies outlined in laws passed by Congress and in memos released by former President Barack Obama in 2009 and by his science adviser, John Holdren, in 2010. In general, those policies attempt to create uniform practices across the federal government for handling and sharing data, using technical evidence, and insulating researchers from political concerns.

An anonymous reader quotes a report from Motherboard: Sam Summers was sitting at home with his penis wrapped in an internet-connected chastity cage when he got a weird message on the app that connects to the device. Someone told him they had taken control and they wanted around $1,000 in Bitcoin to give control back to Summers. "Initially, I thought it was my partner doing that," Summers told Motherboard in a phone call. "It sounds silly, but I got a bit excited by it." But when Summers called his partner, she told him it wasn't her, even after he told her their safe word. That's when he realized he had gotten hacked. His penis was locked in the cage, and he had no way out.

Summers is one of several people who purchased a chastity cage device called Cellmate and produced by Qiui, a China-based manufacturer. Some of the device's owners got their accounts -- and thus their devices as well -- hacked at the end of last year, after security researchers warned that the manufacturer left an exposed and vulnerable API, which could allow hackers to take control of the devices.

Scared and a bit desperate, Summers realized he had some Bitcoin stashed in an old account. So he sent the hacker what they wanted, hoping that would be it. But when the hacker got the money, they asked for more, according to Summers. "That's when I felt fucking stupid and angry," Summers said. At that point, Summers and his partner started brainstorming ways to get his penis out of the cage. At home, they only had a hammer, so they went out and bought a pair of bolt cutters. His partner tried first, but she couldn't break through. So Summers had to do it himself. The way he was holding his penis put it "in a dangerous spot," he said, so it was "very scary." Nonetheless, he was able to break the cage, but the cutters still cut through him, he said. "I don't have a scar or anything but I was bleeding and it fucking hurt," Summers said.

As the U.S. investigation into the SolarWinds hacking campaign grinds on, lawmakers are demanding answers from the National Security Agency about another troubling supply chain breach that was disclosed five years ago. From a report: A group of lawmakers led by Sen. Ron Wyden, D-Ore., are asking the NSA what steps it took to secure defense networks following a years-old breach of software made by Juniper Networks, a major provider of firewall devices for the federal government. Juniper revealed its incident in December 2015, saying that hackers had slipped unauthorized code into the firm's software that could allow access to firewalls and the ability to decrypt virtual private network connections. Despite repeated inquiries from Capitol Hill -- and concern in the Pentagon about the potential exposure of its contractors to the hack -- there has been no public U.S. government assessment of who carried out the hack, and what data was accessed.

Lawmakers are now hoping that, by cracking open the Juniper cold case, the government can learn from that incident before another big breach of a government vendor provides attackers with a foothold into U.S. networks. Members of Congress also are examining any role that the NSA may have unwittingly played in the Juniper incident by allegedly advocating for a weak encryption algorithm that Juniper and other firms used in its software. Lawmakers want to know if, more than a decade ago, the NSA pushed for a data protection scheme it could crack, only for another state-sponsored group to exploit that security weakness to gather data about the U.S. "Congress has a responsibility to determine the root cause of this supply chain compromise and the NSA's role in the design and promotion of the flawed encryption algorithm that played such a central role," Wyden and other lawmakers wrote to Gen. Paul Nakasone, head of the NSA and U.S. Cyber Command, in a letter made public Friday.