×

Submission + - Is It Time to Call BS on "The Retention Policy Ate My Communications" Excuse?

theodp writes: The FTC is accusing Amazon execs, including founder Jeff Bezos, of using encrypted messaging apps that automatically delete messages to communicate, even after they were notified they were under investigation. The FTC is asking a judge to force Amazon to produce documents related to the company’s failure to preserve Signal messages, the company’s document preservation notices, and its instructions about using disappearing messaging applications. The FTC alleges Amazon execs did this while discussing "sensitive business matters, including antitrust" (instead of using email) to destroy potential evidence. Google also came under fire this week in its antitrust case over an issue about whether it intentionally deleted or failed to retain documents that might have been used as evidence in the trial. Google had a policy of having 'history off' on its chats by default, leaving it to employees [including CEO Sundar Pichai] to determine when to turn it on for relevant conversations (akin to some police bodycam policies). The Department of Justice (DOJ) called the alleged destruction of documents "unequivocal and honestly breathtaking," adding that "there’s no question" executives "intentionally had conversations with history off." "Google’s retention policy leaves a lot to be desired," said the judge, adding disapprovingly that it was “surprising to me that a company would leave it to their employees to decide when to preserve documents." And back in 2018, Facebook acknowledged that a secret Messenger retention policy feature was the cause of CEO Mark Zuckerberg's mysteriously disappearing messages.

Which begs the question — are Mission Impossible-like self-destructing email, messaging, and document policies beneficial to rank-and-file employees, or is this more about a play to "reduce your risk in the event of litigation [...] by permanently deleting old content that you're no longer required to keep," as Microsoft explains? Microsoft goes on to claim that destroying all of your employees' communications — like the University of Washington's just-implemented Microsoft Teams Chat Message 'Retention' Project that calls for destroying all of the university's messages after 30 days with 'no exceptions' (UW also suggests other FOIA-dodging 'best practices') — will also "help your organization to share knowledge effectively and be more agile by ensuring that your users work only with content that's current and relevant to them." However, former Microsoft Researcher Jonathan Grudin (coincidentally a UW affiliate professor) found plenty of pushback on the idea of improving-knowledge-by-deleting-communications when the company unsuccessfully tried to make Microsoft employees eat their own retention policy dogfood that the company was selling to other organizations. Grudin explained in a 2021 interview:

"Now I'll describe a couple unpublished projects. One was an email system. Someone said, 'We call it email retention but really it's email deletion.' We were told that starting the next April, all email a year old would be automatically deleted. IBM had such a system and some of our customers wanted it. I contacted friends at IBM who described it as a nightmare. [...] Why did we think it would be a good idea to use it internally at Microsoft? Some guessed storage costs, but those were dropping daily. Well, companies might have bodies that they'd like to remain buried, conversations that they would prefer not to surface. But you can't legally destroy inculpatory evidence, and an embarrassing remark that makes headlines generally has little weight in court where they look for patterns of behavior over time. The real reason turned out to be discovery costs. Microsoft and many companies are involved in far more legal proceedings than you read about. They have to pay attorneys to read all subpoenaed emails. It reportedly came to about $30 million a year. A team of about 10 people were managing the email deletion project. Some had given up other jobs to work on it, because they loved this idea. Most had information management backgrounds. They believed that only records with business value should be kept. Seeing big email folders 'makes my skin crawl,' one remarked. This view came from an era of paper documents and Rolodexes when filing and finding documents was manual. It was really difficult. It was expensive. Whereas for me and others, email is a Rolodex as well as a source of a lot of information whose future value we don't know."

"I learned that 1000 Microsoft employees were testing the software, a process referred here to as eating dogfood. I asked how it was going for these folks. An information manager beamed and said, 'It's working!' [...] I asked, 'What do the employees using it, think about it?' This surprised the team. It never occurred to them to ask. They were sure that the employees would see the value of email deletion for the company. They were really curious. They did realize that a survey and interview might uncover gripes, but they wanted to find out. [...] The interviews, which of course did find ingenious and time-consuming ways that people were dodging deletion. [...] So what did we find? Well, the cost to the company, in lost time and effort from email deletion, would easily exceed $30 million annually. [..] The deployment was canceled. [...] A partner in a San Francisco law firm heard about my findings and called up. He said that some companies would use email deletion software, whatever the cost. He explained, 'Phillip Morris is in the business of addicting people to something that will kill them. They'll pay what they need to as long as the business is profitable. Once it stops being profitable, they'll stop.'"

Submission + - Extremist Militias Are Coordinating in More Than 100 Facebook Groups (wired.com)

An anonymous reader writes: “Join your localMilitia or III% Patriot Group,” a post urged the more than 650 members of a Facebook group called the Free American Army. Accompanied by the logo for the Three Percenters militia network and an image of a man in tactical gear holding a long rifle, the post continues: “Now more than ever. Support the American militia page.” Other content and messaging in the group is similar. And despite the fact that Facebook bans paramilitary organizing and deemed the Three Percenters an “armed militia group" on its 2021Dangerous Individuals and Organizations List, the post and group remained up until WIRED contacted Meta for comment about its existence.

Free American Army is just one of around 200 similar Facebook groups and profiles, most of which are still live, that anti-government and far-right extremists are using to coordinate local militia activity around the country. After lying low for several years in the aftermath of the US Capitol riot on January 6, militia extremists have been quietly reorganizing, ramping up recruitment and rhetoric on Facebook—with apparently little concern that Meta will enforce its ban against them, according to new research by the Tech Transparency Project, shared exclusively with WIRED.

Individuals across the US with long-standing ties to militia groups are creating networks of Facebook pages, urging others to recruit “active patriots” and attend meetups, and openly associating themselves with known militia-related sub-ideologies like that of the anti-government Three Percenter movement. They’re also advertising combat training and telling their followers to be “prepared” for whatever lies ahead. These groups are trying to facilitate local organizing, state by state and county by county. Their goals are vague, but many of their posts convey a general sense of urgency about the need to prepare for “war” or to “stand up” against many supposed enemies, including drag queens, immigrants, pro-Palestine college students, communists—and the US government. These groups are also rebuilding at a moment when anti-government rhetoric has continued to surge in mainstream political discourse ahead of a contentious, high-stakes presidential election. And by doing all of this on Facebook, they’re hoping to reach a broader pool of prospective recruits than they would on a comparatively fringe platform like Telegram.

Submission + - Humans Now Share the Web Equally With Bots, Report Warns (independent.co.uk)

An anonymous reader writes: Humans now share the web equally with bots, according to a major new report – as some fear that the internet is dying. In recent months, the so-called “dead internet theory” has gained new popularity. It suggests that much of the content online is in fact automatically generated, and that the number of humans on the web is dwindling in comparison with bot accounts. Now a new report from cyber security company Imperva suggests that it is increasingly becoming true. Nearly half, 49.6 per cent, of all internet traffic came from bots last year, its “Bad Bot Report” indicates. That is up 2 percent in comparison with last year, and is the highest number ever seen since the report began in 2013. In some countries, the picture is worse. In Ireland, 71 per cent of internet traffic is automated, it said.

Some of that rise is the result of the adoption of generative artificial intelligence and large language models. Companies that build those systems use bots scrape the internet and gather data that can then be used to train them. Some of those bots are becoming increasingly sophisticated, Imperva warned. More and more of them come from residential internet connections, which makes them look more legitimate. “Automated bots will soon surpass the proportion of internet traffic coming from humans, changing the way that organizations approach building and protecting their websites and applications,” said Nanhi Singh, general manager for application security at Imperva. “As more AI-enabled tools are introduced, bots will become omnipresent.”

Submission + - AI Engineers Report Burnout, Rushed Rollouts As 'Rat Race' To Stay Competitive (cnbc.com)

An anonymous reader writes: Late last year, an artificial intelligence engineer at Amazon was wrapping up the work week and getting ready to spend time with some friends visiting from out of town. Then, a Slack message popped up. He suddenly had a deadline to deliver a project by 6 a.m. on Monday. There went the weekend. The AI engineer bailed on his friends, who had traveled from the East Coast to the Seattle area. Instead, he worked day and night to finish the job. But it was all for nothing. The project was ultimately “deprioritized,” the engineer told CNBC. He said it was a familiar result. AI specialists, he said, commonly sprint to build new features that are often suddenly shelved in favor of a hectic pivot to another AI project.

The engineer, who requested anonymity out of fear of retaliation, said he had to write thousands of lines of code for new AI features in an environment with zero testing for mistakes. Since code can break if the required tests are postponed, the Amazon engineer recalled periods when team members would have to call one another in the middle of the night to fix aspects of the AI feature’s software. AI workers at other Big Tech companies, including Google and Microsoft, told CNBC about the pressure they are similarly under to roll out tools at breakneck speeds due to the internal fear of falling behind the competition in a technology that, according to Nvidia CEO Jensen Huang, is having its “iPhone moment.”

Submission + - GitHub Dismisses Critical Backdoor Cloaking Flaw: A Sign of Problems with VRPs?

mimd writes: A former Google security engineer recently flagged a critical UI bug on GitHub where malicious file contents can be hidden from observers. Despite the potential severity, the report was quickly dismissed without review on HackerOne, highlighting an alarming trend in vulnerability response practices. This incident further heightens concern, especially in a year already marred by open source security incidents like the XZ SSH backdoor previously reported here.

The dismissal, especially from a seasoned security professional, underscores a concerning issue within vulnerability reporting platforms (VRPs). The reporter goes on to say that despite including ample details, the report may have been ignored due to the relatively new age of their HackerOne account which they created exclusively to report this bug to Github.

As someone that runs a tech business, I almost get it: You are bombarded by security report spam. But you have to take every one of them as potentially existentially serious. And you have to treat every minor bug or glitch with respect too.

A former CISO described HackerOne as overwhelmed with noise, stating,

"90% of reports are closed without human review."

The repository cited in the reporter's video is still live as of this writing which includes a Makefile whose actual contents are cloaked in the web UI.

Github's VRP response was quoted as saying:

We have reviewed your report and determined that it does not present a security risk.

Submission + - AM Radio Law Opposed By Tech and Auto Industries Is Close To Passing (arstechnica.com)

An anonymous reader writes: A controversial bill that would require all new cars to be fitted with AM radios looks set to become a law in the near future. Yesterday, Senator Edward Markey (D-Mass) revealed that the "AM Radio for Every Vehicle Act" now has the support of 60 US Senators, as well as 246 co-sponsors in the House of Representatives, making its passage an almost sure thing. Should that happen, the National Highway Traffic Safety Administration would be required to ensure that all new cars sold in the US had AM radios at no extra cost. "Democrats and Republicans are tuning in to the millions of listeners, thousands of broadcasters, and countless emergency management officials who depend on AM radio in their vehicles. AM radio is a lifeline for people in every corner of the United States to get news, sports, and local updates in times of emergencies. Our commonsense bill makes sure this fundamental, essential tool doesn’t get lost on the dial. With a filibuster-proof supermajority in the Senate, Congress should quickly take it up and pass it," said Sen. Markey and his co-sponsor Sen. Ted Cruz (R-Texas).

About 82 million people still listen to AM radio, according to the National Association of Broadcasters, which as you can imagine was rather pleased with the congressional support for its industry. “Broadcasters are grateful for the overwhelming bipartisan support for the AM Radio for Every Vehicle Act in both chambers of Congress," said NAB president and CEO Curtis LeGeyt. "This majority endorsement reaffirms lawmakers' recognition of the essential service AM radio provides to the American people, particularly in emergency situations. NAB thanks the 307 members of Congress who are reinforcing the importance of maintaining universal access to this crucial public communications medium."

Submission + - Congress Lets Broadband Funding Run Out, Ending $30 Low-Income Discounts (arstechnica.com)

An anonymous reader writes: The Federal Communications Commission chair today made a final plea to Congress, asking for money to continue a broadband-affordability program that gave out its last round of $30 discounts to people with low incomes in April. The Affordable Connectivity Program (ACP) has lowered monthly Internet bills for people who qualify for benefits, but Congress allowed funding to run out. People may receive up to $14 in May if their ISP opted into offering a partial discount during the program's final month. After that there will be no financial help for the 23 million households enrolled in the program.

"Additional funding from Congress is the only near-term solution for keeping the ACP going," FCC Chairwoman Jessica Rosenworcel wrote in a letter to members of Congress today. "If additional funding is not promptly appropriated, the one in six households nationwide that rely on this program will face rising bills and increasing disconnection. In fact, according to our survey of ACP beneficiaries, 77 percent of participating households report that losing this benefit would disrupt their service by making them change their plan or lead to them dropping Internet service entirely." The ACP started with $14.2 billion allocated by Congress in late 2021. The $30 monthly ACP benefit replaced the previous $50 monthly subsidy from the Emergency Broadband Benefit Program.

Submission + - Change Healthcare Hackers Broke In Using Stolen Credentials, No MFA (techcrunch.com)

An anonymous reader writes: The ransomware gang that hacked into U.S. health tech giant Change Healthcare used a set of stolen credentials to remotely access the company’s systems that weren’t protected by multifactor authentication (MFA), according to the chief executive of its parent company, UnitedHealth Group (UHG). UnitedHealth CEO Andrew Witty provided the written testimony ahead of a House subcommittee hearing on Wednesday into the February ransomware attack that caused months of disruption across the U.S. healthcare system. This is the first time the health insurance giant has given an assessment of how hackers broke into Change Healthcare’s systems, during which massive amounts of health data were exfiltrated from its systems. UnitedHealth said last week that the hackers stole health data on a “substantial proportion of people in America.”

According to Witty’s testimony, the criminal hackers “used compromised credentials to remotely access a Change Healthcare Citrix portal.” Organizations like Change use Citrix software to let employees access their work computers remotely on their internal networks. Witty did not elaborate on how the credentials were stolen. However, Witty did say the portal “did not have multifactor authentication,” which is a basic security feature that prevents the misuse of stolen passwords by requiring a second code sent to an employee’s trusted device, such as their phone. It’s not known why Change did not set up multifactor authentication on this system, but this will likely become a focus for investigators trying to understand potential deficiencies in the insurer’s systems. “Once the threat actor gained access, they moved laterally within the systems in more sophisticated ways and exfiltrated data,” said Witty. Witty said the hackers deployed ransomware nine days later on February 21, prompting the health giant to shut down its network to contain the breach.

Submission + - TSMC Unveils 1.6nm Process Technology With Backside Power Delivery (tomshardware.com)

An anonymous reader writes: TSMC announced its leading-edge 1.6nm-class process technology today, a new A16 manufacturing process that will be the company's first Angstrom-class production node and promises to outperform its predecessor, N2P, by a significant margin. The technology's most important innovation will be its backside power delivery network (BSPDN). Just like TSMC's 2nm-class nodes (N2, N2P, and N2X), the company's 1.6nm-class fabrication process will rely on gate-all-around (GAA) nanosheet transistors, but unlike the current and next-generation nodes, this one uses backside power delivery dubbed Super Power Rail. Transistor and BSPDN innovations enable tangible performance and efficiency improvements compared to TSMC's N2P: the new node promises an up to 10% higher clock rate at the same voltage and a 15%–20% lower power consumption at the same frequency and complexity. In addition, the new technology could enable 7%–10% higher transistor density, depending on the actual design.

The most important innovation of TSMC's A16 process, which was unveiled at the company's North American Technology Symposium 2024, is the introduction of the Super Power Rail (SPR), a sophisticated backside power delivery network (BSPDN). This technology is tailored specifically for AI and HPC processors that tend to have both complex signal wiring and dense power delivery networks. Backside power delivery will be implemented into many upcoming process technologies as it allows for an increase in transistor density and improved power delivery, which affects performance. Meanwhile, there are several ways to implement a BSPDN. TSMC's Super Power Rail plugs the backside power delivery network to each transistor's source and drain using a special contact that also reduces resistance to get the maximum performance and power efficiency possible. From a production perspective, this is one of the most complex BSPDN implementations and is more complex than Intel's Power Via.

Submission + - FCC Votes To Restore Net Neutrality Rules (nytimes.com)

An anonymous reader writes: The Federal Communications Commission voted on Thursday to restore regulations thatexpand government oversight of broadband providersand aim to protect consumer access to the internet, a move that will reignite a long-running battle over the open internet. Known asnet neutrality, the regulations were first put in place nearly a decade ago under the Obama administration and are aimed at preventing internet service providers like Verizon or Comcast from blocking or degrading the delivery of services from competitors like Netflix and YouTube. The rules were repealed under President Donald J. Trump, and have proved to be a contentious partisan issue over the years while pitting tech giants against broadband providers.

In a 3-to-2 vote along party lines, the five-member commission appointed by President Biden revived the rules that declare broadband a utility-like service regulated like phones and water. The rules also give the F.C.C. the ability to demand broadband providers report and respond to outages, as well as expand the agency’s oversight of the providers’ security issues. Broadband providers are expected to sue to try to overturn the reinstated rules.

The core purpose of the regulations is to prevent internet service providers from controlling the quality of consumers’ experience when they visit websites and use services online. When the rules were established, Google, Netflix and other online services warned that broadband providers had the incentive to slow down or block access to their services. Consumer and free speech groups supported this view. There have been few examples of blocking or slowing of sites, which proponents of net neutrality say is largely because of fear that the companies would invite scrutiny if they did so. And opponents say the rules could lead to more and unnecessary government oversight of the industry.

Submission + - Veteran PC game celebrates 40th anniversary (github.io)

sfraggle writes: Biplane shoot-'em up is celebrating 40 years today since its first release back in 1984. The game is one of the oldest PC games still in active development today, originating as an MS-DOS game for the original IBM PC. The 40th anniversary site has a detailed history of how the game was written as a tech demo for the now-defunct Imaginet networking system. There is also a video interview with its original authors.

Submission + - What Comes After OLED? Meet QDEL (arstechnica.com)

An anonymous reader writes: Quantum dots are already moving in the premium display category, particularly through QD-OLED TVs and monitors. The next step could be QDEL, short for "quantum dot electroluminescent," also known as NanoLED, screens. Not to be confused with the QLED (quantum light emitting diode) tech already available in TVs, QDEL displays don't have a backlight. Instead, the quantum dots are the light source. The expected result is displays with wider color spaces than today's QD-OLEDs (quantum dot OLEDs) that are also brighter, more affordable, and resistant to burn-in. It seems like QDEL is being eyed as one of the most potentially influential developments for consumer displays over the next two years. If you’re into high-end display tech, QDEL should be on your radar.

You may know QDEL as NanoLED because that's what Nanosys, a quantum dot supplier developing the technology, calls it. QDEL has gone by other names, such as QLED—before Samsung claimed that acronym for LCD-LED TVs that use quantum dots. You may also see QDEL referred to as QD-EL, QD-LED, or EL-QD. As the alphabet soup suggests, there are still some things to finalize with this tech. This article will mostly use the term QDEL, with occasional references to NanoLED. If none of those names sound familiar, it's probably because you can't buy any QDEL products yet. Suppliers suggest that could change in the next few years; Nanosys is targeting 2026 for commercial availability. [...]

Today's OLED screens use OLED material as their light source, with QD-OLED specifically applying quantum dots to convert the light into color. In QLED, the light source is a white backlight; QDEL displays apply electricity directly to quantum dots, which then generate light. QDEL uses a layer of quantum dots sandwiched between an anode and cathode to facilitates the flow of electricity into the quantum dots. QDEL displays have pixels made of a red quantum dot subpixel, green quantum dot subpixel, and—differing from today's QLED and QD-OLED displays—blue quantum dot subpixel. QDEL displays use the same quantum dot cores that QD-OLED and QLED products use, [Jeff Yurek, Nanosys' VP of marketing] told me, adding, "The functionalization of the outer layer of the [quantum dots] needs to be changed to make it compatible with each display architecture, but the cores that do the heavy lifting are pretty much the same across all of these."

Because QDEL pixels make their own light and can therefore turn off completely, QDEL displays can deliver the same deep blacks and rich contrast that made OLED popular. But with the use of direct-view quantum dots, stakeholders are claiming the potential for wider color gamuts than we've seen in consumer displays before. With fewer layers and parts, there are also implications for QDEL product pricing, longevity, and even thinness. [...] The fact that quantum dots are already being successfully applied to LCD-LED and OLED screens is encouraging for future QDEL products. QDEL stakeholders claim that the tech could bring efficiencies like lower power consumption and higher brightness than OLED. (Research using a prototype device has recorded quantum dot light-emitting diodes reaching 614,000 nits. Of course, those aren't the type of results you should expect to see in a real-life consumer product.) There's also hope that QDEL could eventually last longer than OLED, especially since QDEL doesn't rely on organic materials that can cause burn-in.

Slashdot Top Deals