Government & Policy

Germany widens antitrust probes of Amazon to loop in special abuse controls • ZebethMedia

By zebethcontrolPosted on November 15, 2022Posted in Commerce, Government & PolicyNo Comments

Germany’s antitrust watchdog has moved to widen an existing investigation of Amazon’s business in the market in light of special abuse powers it confirmed are applicable to the ecommerce giant’s business in the country this summer. The Federal Cartel Office (FCO) said yesterday it is extending two ongoing “abuse control proceedings” against Amazon to include the application of “the new instrument for more effective oversight over large digital companies” (aka, Section 19a of the GWB; aka it’s rebooted competition law) — which is a reference to a 2021 reform of German competition law that targets digital giants found to have so-called “paramount significance for competition across markets” with a proactive antitrust regime that outlaws practices such as self-preferencing, denying interoperability and exclusively bundling their own services to the detriment of rival offerings, among other ex ante prohibitions listed in Section 19b of the law. The German law is similar to the pan-EU Digital Markets Act (DMA) which was recently adopted by the bloc — and will come into force next year — so the FCO is ahead of the curve here and its application of special abuse controls may offer a little taster of the extended scrutiny that’s coming down the pipe across the continent for Big Tech. The FCO has two open investigations of Amazon that are being extended to include scrutiny of whether they comply with the rebooted competition regime — one examining price control mechanisms it says are used by Amazon to algorithmically control price setting by third-party sellers on its marketplace; and another proceeding focused on what it dubs “brandgating”, aka “possible disadvantages” for marketplace sellers as a result of various instruments applied by Amazon, such as agreements with (brand) manufacturers on whether individual sellers can or cannot sell (brand) products on the Amazon marketplace. In a statement about the extension of the ongoing proceeding, Andreas Mundt, the FCO’s president, said: “We are examining in both proceedings whether and how Amazon impedes the business opportunities of sellers that are active on the Amazon marketplace and compete with Amazon’s own retail business. Amazon operates the most important marketplace in e-commerce and thus has a key position in that area, which allows the company to set far-reaching rules for competition on its platform. Our new competencies, which are precisely intended to restrict such power to set rules, allow us to intervene more efficiently against Amazon’s anti-competitive practices.” Reached for a response to the development, an Amazon spokesperson sent us this statement — which confirms that it is seeking to appeal the earlier FCO decision that its business falls under the special abuse controls regime (NB: the decision remains enforceable during appeal): “We disagree with the FCO’s interpretation of this complex new legislation, and have filed an appeal. The retail market that Amazon operates in is very large and extraordinarily competitive, online and offline. We continue to cooperate with the Federal Cartel Office in these proceedings.” On pricing, the ecommerce giant refutes it indulges in any abusive practices — arguing generally that its business succeeds when sellers succeed, and claiming third party sellers set their own product prices on its marketplace. As regards the FCO’s brandgating probe, Amazon claims it never makes changes to selling privileges without a good reason — further suggesting that any amendments it does make to how sellers can operate are intended to ensure a trusted shopping experience for customers, such as by protecting shoppers from illegitimate goods. While Amazon continues to come out fighting aggressively against multiplying accusations of antitrust abuse, competition scrutiny continues to pile up in Europe and beyond. A Europe Union competition investigation of the ecommerce giant’s use of third party seller data has been grinding on for years — and an attempt by Amazon to settle the probe this summer, by offering a set of commitments, was swiftly denounced by dozens of civil society and digital rights groups as weak sauce. A few days later Commission EVP and competition chief Margrethe Vestager warned the company its offer wasn’t good enough. The EU is still considering industry feedback on Amazon’s commitments so it remains to be seen where that pan-EU antitrust procedure will land. This summer the UK’s Competition and Markets Authority also announced its own investigation into Amazon’s marketplace — although it’s a few years behind so still has to do the work of determining whether Amazon has a dominant position in the market and, only if it confirms that’s the case, look at whether it’s abusing that position and distorting competition by giving an unfair advantage to its own retail business or sellers using its services vs third party sellers who aren’t. So the UK is lagging other European regulators in scrutiny of Amazon. Outside Europe, Amazon is fighting antitrust accusations — and lawsuits — on home soil too after years of increasing scrutiny by US lawmakers on Big Tech’s market power.

Google to pay $391.5 million in location-tracking settlement with 40 states • ZebethMedia

By zebethcontrolPosted on November 14, 2022Posted in Google, Government & Policy, lawsuit, Privacy, settlementNo Comments

Google has agreed to a $391.5 million settlement with 40 state attorneys general over its location tracking practices. The settlement outlines that Google misled its users into thinking they had turned off location tracking even as the company continued to collect their location information. The investigation, which marks the largest attorney general-led consumer privacy settlement ever, was co-led by Oregon and Washington. “For years Google has prioritized profit over their users’ privacy,” said Oregon Attorney General Ellen Rosenblum in a news release. “They have been crafty and deceptive. Consumers thought they had turned off their location tracking features on Google, but the company continued to secretly record their movements and use that information for advertisers.” Google said in a statement that it has already addressed and corrected some of the location tracking practices detailed in the settlement. “Consistent with improvements we’ve made in recent years, we have settled this investigation which was based on outdated product policies that we changed years ago,” a spokesperson for Google told ZebethMedia in an email. As part of the settlement, Google has agreed to improve its location tracking disclosures and user controls starting next year. The settlement requires Google to show additional information to users whenever they turn a location-related account setting on or off. Key information about location tracking must also not be hidden going forward. In a blog post, Google outlined it will “provide a new control that allows users to easily turn off their Location History and Web & App Activity settings and delete their past data in one simple flow.” The company also plans to add additional disclosures to its Activity controls and Data & Privacy pages. Alongside these changes, Google is going to create a comprehensive information hub that highlights key location settings. In addition, Google plans to give users who are setting up new accounts a more detailed explanation of what Web & App Activity is and what information it includes. The company said it will continue deleting location history data for users who have not recently contributed new location history data to their account. “Until we have comprehensive privacy laws, companies will continue to compile large amounts of our personal data for marketing purposes with few controls,” Rosenblum said in the news release. The attorneys general opened the Google investigation after a 2018 Associated Press report found that the company recorded users’ movements even when they explicitly told it not to. The investigation found that Google violated state consumer protection laws by misleading consumers about its location tracking practices since at least 2014. Last month, Google agreed to pay the state of Arizona $85 million to settle a separate lawsuit that alleged the search giant deceived users by collecting location data without their consent. Google is also currently facing a lawsuit from Washington, DC, Texas, Washington state and Indiana. The lawsuit alleges that Google deceived users by collecting their location data even when they believed that kind of tracking was disabled.

Is Elon Musk’s Twitter about to fall out of the GDPR’s one-stop shop? • ZebethMedia

By zebethcontrolPosted on November 14, 2022Posted in Elon Musk, GDPR, Government & Policy, Privacy, Social, TwitterNo Comments

Helmed by erratic new owner Elon Musk, Twitter is no longer fulfilling key obligations required for it to claim Ireland as its so-called “main establishment” under the European Union’s General Data Protection Regulation (GDPR), a source familiar with the matter has told ZebethMedia. Our source, who is well placed, requested and was granted anonymity owing to the sensitivity of the issue — which could have major ramifications for Twitter and for Musk. Like many major tech firms with customers across the European Union, Twitter currently avails itself of a mechanism in the GDPR known as the one-stop shop (OSS). This is beneficial because it allows the company to streamline regulatory administration by being able to engage exclusively with a lead data supervisor in the EU Member State where it is ‘main established’ (in Twitter’s case Ireland), rather than having to accept inbound from data protection authorities across the bloc. However, under Musk’s chaotic reign — which has already seen a fast and deep downsizing of Twitter’s headcount, kicking off with layoffs of 50% of staff earlier this month — questions are being asked over whether its main establishment status in Ireland for the GDPR still holds or not. The resignation late last week of key senior personnel responsible for ensuring security and privacy compliance looks like a canary in the coal-mine when it comes to Twitter’s regulatory situation — with CISO Lea Kissner; chief privacy officer Damien Kieran; and chief compliance officer Marianne Fogarty all walking out the door en masse. It’s not clear whether any adequately qualified individuals will be willing to step into these critical compliance roles for privacy and security at Twitter given the current Musk-driven craziness — since anyone signing up for that level of responsibility risks opening themselves up to personal liability should regulatory requirements be breached on their watch. As we reported Friday, Musk’s attorney and now head of legal at Twitter, Alex Spiro — who has reportedly been given a key role in the overhaul of the platform — emailing all staff on behalf of “Elon” to claim they face no personal liability will surely sound alarm bells at regulators over Twitter’s direction of travel. Last week, The Verge also reported on turmoil inside Twitter’s privacy and security function as standard review procedures were dispensed with and engineers were asked to “self certify” compliance with FTC rules. Its report also cited an unnamed company lawyer who it said had Slacked employees to warn them that changes to how Twitter operates is piling personal, professional and legal risk onto engineers instructed to implement Musk’s will regardless of consequences. Under the EU’s GDPR, meanwhile, Twitter is obliged — in just one very basic requirement — to have a data protection officer (DPO) to provide a contact point for regulators. Hence the departure of Kieran, its first and only DPO since the role was created at the company in 2018, has not gone unnoticed by its data protection watchdog in Ireland — as we also reported Friday. But the Irish Data Protection Commission (DPC)’s concerns are already spiralling wider than Twitter’s compliance with notifications about core personnel: Last week, the authority — currently Twitter’s lead EU DPA under the GDPR’s OSS — put the social media firm on watch by signalling public concern when it said it would be putting questions to the company about the status of its main establishment in Ireland at a meeting scheduled for early this week, to discuss all the recent privacy changes since the Musk takeover. Twitter has not commented publicly on the DPC’s warning nor on the departures of senior regulator-facing staffers. Indeed, since Musk took over, its communications department appears to have been dismantled and the company no longer responds to press requests for comment — so it was not possible to obtain an official statement from Twitter about these departures or on the substance of our report. (We’re happy to add a response if Twitter or Musk wants to send us one.) For Twitter’s business itself, there are a number of potential consequences in play if its ability to meet regulatory requirements falls. If the DPC assesses (or is informed by Musk) that it no longer has its main establishment in Ireland the company will crash out of the OSS — opening it up to being regulated by data protection authority across the bloc’s 27 Member States which would become competent to oversee its business. In practice, that means any EU data protection authority would be able to act directly on concerns it has that local users’ data is at risk — with the power to instigate their own investigations and take enforcement actions. So Ireland’s more business friendly regulator would no longer be leading the handling of any GDPR concerns about Twitter; probes could be simultaneously opened up all over the EU — including in Member States like France and Germany where data protection authorities have a reputation for being quicker to the punch (and/or more aggressive) in responding to complaints compared to Ireland. If Twitter loses its ability to claim main establishment in Ireland it would therefore drastically amp up the complexity, cost and risk of achieving GDPR compliance. (Reminder: Penalties under the regulation can scale up to 4% of annual global turnover — so these are not rules a normal CEO would ignore.) The GDPR does not set out specific criteria for assessing main establishment. But, in Twitter’s case — in order for it to be able to fulfil the regulation’s requirement of “effective and real exercise of management activities determining the main decisions as to the purposes and means of processing through stable arrangements” actually taking place locally, in Ireland, despite Twitter product development being led out of the US — we understand that the company devised a careful legal framework which was designed to empower an Irish entity to be the data controller for EU users by ensuring that this Ireland-located Twitter company, which has its own board of directors subject to

The dilemma of Chinese startups going global • ZebethMedia

By zebethcontrolPosted on November 14, 2022Posted in Government & Policy, Startups, VentureNo Comments

One day in 2020, I published an article about a Chinese hardware maker which would have otherwise been a typical funding story. Instead, I got a complaint from its PR asking me to remove all mentions of “China” from the piece. The startup wanted to be called “American” on the basis of its having a small office in California. I declined, insisting on our duty to uncover relevant facts for readers. I never heard from the company again. That turned out to be just the beginning of a trend in my interaction with Chinese startups that are expanding abroad. “We don’t want to be seen as Chinese,” many of them tell me. My attitude has over time gone from disappointment at companies’ lack of respect for journalistic independence to a growing concern that my portrayal of them might unfairly prejudice their growth. By putting the Chinese label on them, these firms might lose business partners, get stricter oversight by app stores, and receive more scrutiny from local regulators. What used to be a no-brainer geographic categorization of a company — “it is Chinese/based in China” — has become politically charged. Five years ago, a Chinese firm would be boasting its “successful entry into Europe” as a Chinese firm. These days, with rising tensions between China and the West, many globalizing Chinese companies choose to bury their origin. They worry that their links to home — however it is defined — can be viewed as a national security threat to the foreign market they serve. “We are going from longing China to longing Chinese, like Eric Yuan.” As startups build increasingly distributed teams, it’s also become harder to put a geographic pin on them. The world’s largest crypto exchange Binance, which started out in China, famously doesn’t have a headquarters. “If you look at companies such as Tiktok, Binance, Grab…these startups all started from day one with a global market in mind and built with teams located in multiple jurisdictions. It is really difficult to label them as from a certain country” said Ron Cao, who’s an early investor in Pinduoduo and founder of Sky9 Capital, an early-stage VC with a presence in China, Singapore, and the U.S. But Chinese startups aren’t just concealing their origin. Many of them are in effect moving legally and operationally to distance themselves from their homeland to reassure foreign authorities that they aren’t beholden to Beijing. The upside of decoupling is companies end up investing more in localization, which is always conducive to overseas expansion. But in the process, they also risk losing some of the advantages of being Chinese. The journey of becoming less “Chinese” is long and complicated, and the extent to which companies choose to reduce their ties to home is playing out differently across sectors and the stage of their business. But there’s one overarching sentiment shared by the dozen entrepreneurs I spoke to: They have never felt more confident about competing with international rivals, thanks to the talent and knowledge they have accumulated at home. But they are also increasingly daunted by — and weary of the geopolitical uncertainty they face in the process. Decoupling from home U.S.-China relations sharply deteriorated under former President Trump’s reign from 2017 to 2021, and President Biden seems to be staying the course, taking a firm stance on China with a sweeping chip ban. Having seen how U.S. sanctions have kneecapped Huawei’s supply chains and the spate of regulatory scrutiny on TikTok in the West, startups fear that they might be the next to get caught between the two superpowers. Companies play down their Chinese association as a result. In the past, startups might get a pass by simply claiming they are Singapore or San Francisco-based without actually having a meaningful operation in those places. Shein, for example, used to bill itself as being “founded in L.A.” when in reality it started out in Nanjing and Guangzhou as a typical Chinese e-commerce exporter leveraging the country’s robust supply chains. But scrutiny by foreign politicians and the press are driving Chinese firms to ramp up their overseas footprint, especially when they reach a critical size. Recently, Shein announced plans to open major warehouses in North America. The company has moved most of its assets to Singapore and made the island nation — which is widely regarded as politically neutral — its headquarters. Sky Xu, the founder and CEO of Shein, is also reportedly seeking Singaporean citizenship. Several entrepreneurs told me that top VC firms in China now provide passport shopping as part of their post-investment service for founders targeting overseas markets in response to a new rule on offshore IPOs: last December, China’s securities authority proposed that a company, regardless of where it’s incorporated, must go through a filing process with the Chinese government if its main management mostly consists of Chinese nationals or executives who live in China, and whose main business operation is in China. “If you look at companies such as Tiktok, Binance, Grab…these startups all started from day one with a global market in mind and built with teams located in multiple jurisdictions. It is really difficult to label them as from a certain country.” Getting the overseas legal setup is just the first step. The greater challenge lies in winning the trust of local regulators and customers. The founder of a productivity app that is targeting the U.S. market told me that “everything we use at work is non-Chinese,” so all of its data, internally or those of its end users, are kept offshore. Rather than ByteDance’s Lark and Alibaba’s Dingtalk, the startup uses Notion and Slack for internal communication, AWS for data hosting, and Stripe for payments. The company was founded in Shenzhen but is in the process of setting up a Singaporean company to be its holding entity. For enterprise software providers, the need to localize is even more pressing. While consumer app developers might gain traction without having to leave their China office, as they can

Twitter’s lead EU watchdog for data protection has fresh questions for Musk • ZebethMedia

By zebethcontrolPosted on November 11, 2022Posted in DPC, Elon Musk, GDPR, Government & Policy, Privacy, Social, TwitterNo Comments

In parallel with the FTC’s ominous warning to Elon Musk’s Twitter yesterday — that ‘no CEO or company is above the law‘ — the microblogging platform’s lead regulator in the European Union is on its case in the wake of senior staffers in charge of security and privacy compliance walking out the door. Graham Doyle, a deputy commissioner at Ireland’s Data Protection Commission (DPC), which currently leads oversight of Twitter under the EU’s General data Protection Regulation (GDPR), told ZebethMedia it’s in contact with the company following media reports yesterday that its data protection officer (DPO) had resigned. A meeting between the DPC and Twitter will take place early next week, according to Doyle. He also confirmed to us that Twitter had not informed the regulator of the DPO’s departure prior to the media reports. Getting clarity over the DPO situation will be top of the meeting agenda, per Doyle. But he said the regulator now has another concern it wants to discuss with Twitter — regarding whether Twitter’s main establishment, for GDPR purposes, is still located in Ireland… Next stop: One-stop-shop stopped? “One of the issues that we want to discuss is the issue around main establishment,” Doyle told ZebethMedia. “They’re obliged to have a data protection officer in place and provide us with the details but equally, under the [GDPR] one-stop-shop (OSS) mechanism in order to get a main establishment to engage with one regulator, the decision making processes — in terms of the processing of EU data — needs to take place in that country. That’s one of the principles of main establishment. And what we want to establish is that that is continuing to be the case for Twitter.” Ireland being Twitter’s lead regulator for the GDPR under the OSS is important because it puts the Irish watchdog in the driving seat when it comes to opening inquiries (or not), or otherwise acting on concerns over Twitter’s compliance (such as following up on the un-notified resignation of its DPO now). From Twitter’s point of view, the arrangement is advantageous because it streamlines compliance since it only needs to liaise with one (lead) regulator over any issues, rather than handling inbound from multiple data protection agencies (potentially in different languages). Ireland has a lead supervisor role for Twitter because the company was able to notify its Dublin office as its “main establishment” in the EU — what the regulation refers to as either the place of “central administration in the Union” or “where the main processing activities take place in the Union”. However were Twitter to be deemed to no longer have this processing base in Ireland there would be an immediate regulatory reconfiguration and data protection authorities across the bloc, from any of the EU’s 27 Member States, could instigate inquiries or act on local complaints themselves — cranking up the regulatory complexity, velocity and risk for Twitter’s European business. With Musk slashing 50% of Twitter’s headcount globally just last week — and a reported “carnage” in the Irish office, per an Irish Times report which said more than 50% of local staff were affected — questions have arisen in Dublin over the stability of its main establishment status for the GDPR. “We’ve made contact with Twitter.. And for us one of the issues we want to discuss with them is the issue of main establishment — is there any change? With the announcement of the departures — including the DPO — is there any plans to change the decision making process that’s in place that allows them to avail of the main establishment,” Doyle reiterated. Reports that all was not well up at the senior echelons of Twitter’s security and privacy function spilled out onto Twitter yesterday afternoon. Platformer journalists, Casey Newton and Zoë Schiffer, reported that Twitter’s CISO, chief privacy officer and chief compliance officer has all resigned — citing messages shared in Twitter Slack which they had obtained. Soon afterwards, the Washington Post’s Cat Zakrzewski tweeted that the Irish DPC was “seeking more information” from Twitter. According to messages shared in Twitter Slack, Twitter’s CISO, chief privacy office, and chief compliance officer all resigned last night. An employee says it will be up to engineers to “self-certify compliance with FTC requirements and other laws.” — Casey Newton (@CaseyNewton) November 10, 2022 NEW: A senior member of Twitter’s legal team just posted this message in Slack:“Everyone should know that our CISO, Chief Privacy Officer and Chief Compliance Officer ALL resigned last night. This news will be buried in the return-to-office drama. I believe that is intentional.” — Zoë Schiffer (@ZoeSchiffer) November 10, 2022 Twitter CISO Lea Kissner later confirmed her departure in a tweet — as did Damien Kieran, Twitter’s now ex chief privacy officer. While Marianne Fogarty, Twitter’s (reportedly ex) chief compliance officer, tweeted what may be an indirect confirmation too late yesterday — writing: “Therapy Thursdays have taken on new meaning of late. #LoveTwitter”. Enquiries to Twitter’s press line have gone unanswered since Musk took over so it’s not been possible to obtain an official line on what’s going on. The company’s communications department appears to have been a major casualty of the 50% headcount reduction Musk swiftly applied on taking over — with press staffers either entirely or almost entirely laid off. It also not clear how many of Twitter’s staff in Ireland were laid off last week. There is no obligation on the company to report overall layoffs numbers to the DPC. Nor is the criteria a regulator should use for assessing main establishment clear as it is not stipulated in the GDPR itself — but rather left up to regulators to determine. (On determining main establishment, the regulation states: “The main establishment of a controller in the Union should be determined according to objective criteria and should imply the effective and real exercise of management activities determining the main decisions as to the purposes and means of processing through stable arrangements” — further stipulating that “criterion should not

SoftBank, NEC, Sony, Toyota + more team up for Rapidus, Japan’s bid for next-gen chip domination • ZebethMedia

By zebethcontrolPosted on November 11, 2022Posted in Enterprise, Government & Policy, Japan, semiconductors, VentureNo Comments

As the tech war between the U.S. and China intensifies, Japan has spotted an opening to build a viable alternative for semiconductors — not least so that its own consumer electronics firms do not run out of memory chips. Now, eight major Japanese tech firms and car makers, including Kioxia, NEC, NTT, SoftBank, Sony and Toyota, are teaming up in a consortium to launch an advanced chip maker. Rapidus, as it will be called, aims to develop and mass-produce the next generation of logic semiconductors by 2027. The Japanese government said Friday it will back Rapidus with 70 billion yen (~$500 million), joining the eight tech corporations to reduce its dependency on chip production in other countries like Taiwan. According to Japan’s industry ministry, each participating company will invest approximately 1 billion yen (~$ 7 million) in Rapidus, with MUFG Bank injecting 300 million yen. “Semiconductors are going to be a critical component for developing new leading-edge technologies such as AI, digital industries and health-tech,” Minister of Economy, Trade and Industry Yasutoshi Nishimura said at a news conference today. “Semiconductors are becoming even more important from an economic security perspective” due to the rising geopolitical risks. Last week, Japan unveiled its plan to allocate 350 billion yen ($2.38 billion) to build a joint research center with the U.S. with the goal of developing 2-nanometer advanced chips. A number of research institutions and semiconductor companies in the U.S, Japan and Europe will participate in the research hub to collaborate. In addition to the new joint research hub investment, the Japanese government plans to invest 450 billion yen in advanced production and 370 billion yen in securing materials required for manufacturing. IBM is reportedly partnering with Rapidus, which will have to get a license from IBM to manufacture sub-2 nanometer chip technology in Japan. Rapidus aims to develop 2-nanometers chips, which can be used for 5G, quantum computing, data centers, self-driving vehicles and digital smart cities. Japan has previously subsidized global semiconductor allies, including Taiwan Semiconductor Manufacturing, Micron, and Western Digital, to expand their chip production in Japan. The idea here is to strengthen its competitiveness in the semiconductor sector with R&D and production of its own advanced chips, primarily for Japanese car makers and tech companies’ use, but potentially for others, too. While global competitors have outperformed in the industry, Japan’s latest logic semiconductor production lines are for 40-nm chips, per media outlet. Samsung has started mass production of 3 nm this year, and TSMC plans to begin its 3 nm mass production late this year.

FTC warns ‘no CEO or company is above the law’ if Twitter shirks privacy order • ZebethMedia

By zebethcontrolPosted on November 10, 2022Posted in elon buys twitter, Elon Musk, FTC, Government & Policy, Privacy, Social, TwitterNo Comments

The FTC has telegraphed what appears to be a now-inevitable investigation into Twitter’s internal data handling practices, as the company continues to shed important staff and improvise new features. “No CEO or company is above the law,” the agency said in a statement — and if Elon Musk’s Twitter continues its current spree, they may find themselves in violation of the FTC’s order and facing serious consequences. To be clear at the outset, the FTC has not announced any investigation into Twitter, Elon Musk, or even that they are gathering information in service of such an investigation. Nor would it be able to confirm it was investigating if it was. But circumstantial evidence, common sense, and the ominous statement issued today leave little doubt that the company is in the agency’s crosshairs. In the course of its ordinary oversight duties, the FTC looks into complaints by consumers, companies, and anyone with a bone to pick about things like misleading advertising, broken privacy promises, illicit business arrangements, and so on. But in 2011 Twitter agreed to a consent decree with the regulator after being found to have misused user data. It was also found to have done so again for many years in an investigation culminating in a $150 million settlement earlier this year, so this isn’t some bygone red tape. This decree required Twitter to establish and maintain a program to ensure and regularly report that its new features do not further misrepresent “the extent to which it maintains and protects the security, privacy, confidentiality, or integrity of any nonpublic consumer information.” The revised order adds more oversight and gives the FTC more power, since evidently Twitter needed a stick as well as a carrot. The gist of it is that Twitter is in the doghouse with the FTC already, and it has specific and legally binding requirements regarding what it can and can’t do with data, and how it verifies that it is in compliance. Around the time of the settlement, Elon Musk entered the stage and now we have all… this. But the news that last night several data handling executives, no doubt important to walking the line with a watchful regulator, all reportedly left at once. Literally minutes after I wrote this paragraph, the company’s head of trust and safety, Yoel Roth, was reported to be leaving as well. NEW: A senior member of Twitter’s legal team just posted this message in Slack:“Everyone should know that our CISO, Chief Privacy Officer and Chief Compliance Officer ALL resigned last night. This news will be buried in the return-to-office drama. I believe that is intentional.” — Zoë Schiffer (@ZoeSchiffer) November 10, 2022 This would be troubling at any company, at any time, under any level of federal scrutiny. But for Twitter the departing chiefs might as well have hired a skywriter to spell out “INVESTIGATE ME” in huge letters above Twitter HQ. (Of course normally that might apply to any number of companies in downtown San Francisco, but right now there’s little question.) The amount of changes, new products, eliminations of various departments and processes (many of which had to do with privacy, fairness, data handling and other crucial topics) don’t mean Twitter is necessarily in violation of the consent decree. But with things going the way they are, it’s quite hard to imagine that it is in compliance now, or it is is, will remain so for long. It’s important, though, to understand that the FTC isn’t like the FBI, kicking doors down and arranging evidence in damning dioramas. The FTC conducts its investigations privately and at great length — they can’t and don’t publicize the fact that they are looking into a company for some violation or another until there is a legally binding consequence like a signed consent decree, settlement, or a decision to go to trial via the Department of Justice. Although many expected the FTC under the leadership of tech skeptic and very smart person Lina Khan to be more proactive, it is limited by law what it can do. It’s actually a bit surprising that the agency got as spicy as it did in the full statement: We are tracking recent developments at Twitter with deep concern. No CEO or company is above the law, and companies must follow our consent decrees. Our revised consent order gives us new tools to ensure compliance, and we are prepared to use them. Though it stops short of saying “We are sharpening our knives,” this statement nevertheless is about as strong an implication that they will be giving Twitter a call soon as they can make. (A juicy tidbit uncovered by CNN’s Brian Fung, while enticing, could relate to ongoing discussions regarding the $150M settlement, so don’t get too excited.) If they decide to pursue an investigation, which would probably happen if there are any red flags at all, let alone this many, it will be done confidentially — but importantly, it is not secret. That means that although it is the FTC’s policy not to reveal or comment on an investigation, a company or person being investigated may do so at any time if they wish. So if the FTC makes a formal request for certain data from Twitter, or deposes its executives (present or former), they may decide to publicize that information. In fact Twitter did this in late 2020, long before the settlement with the FTC was finalized. After all, you don’t want your investors to be the last to hear about something like a $150M charge, even though in telling them you risk discovery by hawk-eyed journalists. So if the FTC investigates Twitter, it’s far more likely that we will hear about it from the company — in a filing with investors or, more likely, from its incautious and prolix CEO during one of his increasingly frequent emergency meetings. The state of chaos at Twitter makes the commonplace observation that we don’t know what it will look like in six months

Who’ll get the last laugh over Musk toying with Twitter’s veracity? • ZebethMedia

By zebethcontrolPosted on November 10, 2022Posted in disinformation, Elon Musk, EU Code of Practice on Disinformation, Government & Policy, Social, TwitterNo Comments

Twitter’s painstakingly layered infosphere looks to be light-speeding back to chaotic noise under new owner Elon Musk. The billionaire is no fan of meritocratic signals nor, it seems, a friend to genuine information — preferring anyone pay him $8/m to have their account on his microblogging social network badged with a check-mark that looks like the old Twitter verification check yet does not involve Musk’s Twitter checking they are who they say they are. In short, it’s a joke made real. Now, in order to verify if a check mark displayed on a Twitter account is a legacy verification of actual identity — or just a late stage capitalism status symbol for Musk’s most loyal fanboys — users must click on the check symbol next to an account name and read the small print that pops up and will either read: “This account is verified because it’s notable in government, news, entertainment, or another designated category” (aka, it’s pre-Musk Twitter verified); or “This account is verified because it’s subscribed to Twitter Blue” (aka, not verified; but yes probably a Musk super fan). At the time of writing, there is no ‘at a glance’ way to distinguish between the old ‘identify verified’ Twitter check mark and non-verified paying subscribers. It’s inherently confusing — presumably intentionally so, given Musk’s love of trolling. He certainly wasted no time laughing about the informational chaos he’d wrought… (At least, we *think* the below account posting crying-with-laughter emojis is him but who can tell anything on Twitter these days?) Screengrab: Natasha Lomas/ZebethMedia Musk’s new Twitter Blue subscription product enables imposters and other purveyors of misinformation to assume (and, if they wish, trash) reputations of others, one check-marked tweet at a time — as immediately started happening on launch — just so long as they can sign up for an $8 charge to pay for Musk’s “leveller” tool. Early targets for impersonation by Twitter Blue subscribers have included basketball star LeBron James, former president George W Bush, former UK prime minister Tony Blair, and tech and gaming brands Apple, Nintendo and Valve Software among others. Account bans followed for some of these impersonator accounts soon after — but the barrier to entry to Musk’s chaos game is incredibly low so plenty more trolls will surely follow. (Hence Twitter’s new nickname being ‘$8chan’.) Twitter Blue is also touted to boost the visibility of subscribers’ tweets vs non-subscribers thereby skewing the information surfaced by the platform’s algorithms — and most likely eroding the visibility of quality information (based on who’s happy to pay vs who’s not). As we’ve reported before, the risks aren’t just reputational (nor to information quality on Twitter): Scams and fraud could easily result if genuine Twitter users are taken in by a fake that’s seeking to harvest their personal information for identity theft or pointing them towards malicious websites to try to run phishing scams to compromise financial information or other sensitive data. Still, as Twitter users everywhere feel the chill of Twitter Blue diluting the veracity of verification signals available on the platform (is it an actual politician or a troll? Maybe that is Musk’s joke?), spare a thought for the European Union — whose reputation as a global regulator risks taking a major nose dive in the Musk-Twitter era. Thing is, Twitter is an existing signatory to the EU’s recently beefed up Code of Practice on Disinformation — a voluntary set of “commitments and measures” platforms agree to apply with the goal of combating the spread of misinformation and disinformation online. Seriously. Musk-owned Twitter is technically already signed up to actively fight disinformation. Yes, we lol’d too. If you take a look at the specifics of what Twitter’s prior leadership team signed the business up for it makes especially awkward reading for Musk-Twitter (and/or the European Commission) — with a requirement on the platform to “limit impermissible manipulative behaviours and practices” by having in place (and/or further bolstering) policies against “impersonation” (emphasis ours); and against “the creation and use of fake accounts“, to name just two especially relevant “behaviors and practices” Twitter is supposed to be discouraging rather than amplifying per this EU Code. Twitter is also signed up to Commitment 18 of the Code — which is summarized in its subscription document as (again, with our emphasis): “Relevant Signatories commit to minimise the risks of viral propagation of misinformation or disinformation by adopting safe design practices as they develop their systems, policies, and features.” Hands up anyone who thinks Musk’s chaotic product iteration at Twitter since taking over as “Chief Twit” fits the bill for “safe design practices”? Er… anyone? No, of course not. It took Musk a matter of hours to kill an “official” extra layer of verification — which took the confusing form of a duplicate check mark and ‘official’ label (yes, srsly) — and had been (very) briefly applied to a sub-set of (legacy) verified accounts by certain of the remaining Twitter staff after Musk fired the other half of the company in a massive cost cutting drive immediately on taking over. “I just killed it,” Musk tweeted yesterday in response to (legacy verified) YouTuber Marques Brownlee — who had just spotted that the ‘Official’ badge he’d also just spotted was now missing; aka, AWOL soon after materializing. So, basically: Ohhai chaos! “Blue check will be the great leveler,” was all Musk offered by way of public explanation at the time. Trust & safety features that come and go within a matter of days/hours/minutes — and product launches that drastically impact trust & safety being rushed out without zero care and attention to their impact on, um, trust & safety — is the new normal at Musk-Twitter. The Chief Twit said as much — tweeting soon after nixing the extra ‘Official’ label: “Please note that Twitter will do lots of dumb things in coming months. We will keep what works & change what doesn’t.” Which is really another way of Musk taking a pen to the Disinformation Code and

Apple limits AirDrop ‘everyone’ option to 10 minutes in China • ZebethMedia

By zebethcontrolPosted on November 10, 2022Posted in airdrop, Apple, censorship, China, Government & Policy, HardwareNo Comments

A change in the iOS 16.1.1 update for Chinese users is turning some heads. Apple is restricting the “Everyone” option in AirDrop to ten minutes on iPhones purchased in mainland China, according to online user reports. That means people can no longer keep their Airdrop on for an unlimited time, including for strangers and contacts. Some argue that this feature should have long been an option for all Apple users — sometimes one just forgets to switch Airdrop off and end up with unsolicited content from unknown users — but others interpret the decision as Apple’s response to recent incidents in China. Airdrop, which uses Bluetooth Low Energy and peer-to-peer wifi technology to enable instant file transferring, remains one of the few uncensored communication medium in China, which is why people were using the feature to share politically sensitive content with others in recent weeks as the country’s top leadership reshuffled. Despite the rise of local rivals like Huawei and Oppo, Apple has managed to hold onto its dominance in China, especially among more affluent demographics. In the second quarter, iPhones accounted for 13% of handset shipments in China, according to Counterpoint’s research, down from 18% and 22% in Q1 and Q4 respectively. It’s not unusual for Apple to introduce region-specific restrictions to abide by local regulations. In EU countries, for example, users can’t exceed the EU Volume Level as a result of hearing protection standards. In China, Apple has a history of applying more stringent rules on content-related services, including games and podcasts, a closely watched area by the local authorities.

VC investors and startup founders see hope in the red wave that wasn’t • ZebethMedia

By zebethcontrolPosted on November 9, 2022Posted in 2022 midterm elections, EC venture capital, Government & Policy, Politics, Startups, VentureNo Comments

Janna Meyrowitz Turner’s biggest concern going into the U.S. midterm elections was that more than half of American voters had an election denier on their ballot. She was quite nervous, alongside pundits and polls who expected a red wave, a conservative flush that would take hold of Congress, state legislatures, and city halls. That didn’t happen. Instead, many candidates backed by Donald Trump failed to garner voters. Pro-abortion, anti-slavery, and pro-marijuana proposals passed while a young and diverse crop of politicians were elected at federal, state, and local levels. The red scare was nipped. For now, at least. “By and large, these candidates lost and will continue to do so,” Turner, the founder of Synastry Capital and co-founder of the coalition VCs for Repro, told ZebethMedia. “Despite the deliberate barriers to keep Black, brown, young, and new Americans from voting, these folks turned out in record numbers, which means our government will start to better reflect our citizens.” All in all, Democrats fared better than expected and are predicted to maintain control of the Senate, while Republicans are favored to take hold of the House. ZebethMedia conducted a vibe check with investors and founders to gauge how they feel as results continue trickling in. Many were happy with the progress being made, while others spoke of the issues they aim to tackle next as calls increase for progressive investors to start speaking up. “Democracy was the real winner last night, which is the underpinning of everything.” Jana Meyrowitz Turner, investor, Synastry Capital Naturally, one issue on everyone’s mind was abortion. Voters in many states had to vote on abortion-related proposals since the overturn of Roe v. Wade left such decisions in the hands of states. Shortly before the midterm elections, more than 100 VC firms came together to create VCs for Repro, a coalition rallying investors to vote in favor of reproductive health and wield more of their sociocultural power for change. Ballot results show that VCs for Repro’s cries were part of a larger clamor to protect reproductive autonomy. Kentucky voted against amending its state constitution to say that there was no right to abortion; Vermont, Michigan, and California voted to make reproductive freedom a constitutional right. Turner noted that pundits and polls drastically underestimated how much Americans support abortion. If it wasn’t clear then, though, it is now.