FCC to finally publish net neutrality order, and lawyers can't wait

The battle to save net neutrality is about to heat back up.
The Federal Communications Commission is on the verge of officially publishing its order demolishing the rules that protected a free and open internet, and activists actually have a reason to look forward to it. Why? Think lawsuits.

A quick look at the webpage of the Federal Register shows that the order axing net neutrality will be published Thursday, and, according to Reuters, that will give those opposed to FCC Chairman Ajit Pai's vision of the internet a chance to fight back.

That's because once that ruling, known as the Restoring Internet Freedom order (ha!), officially drops, opponents will have something to sink their teeth into and can begin the long process of fighting the rules in court.

You'll likely remember that the order in question was passed by the FCC with a vote of 3-2, and at the time Pai insisted everything was going to be totally cool.

"It is not going to end the internet as we know it," he observed (possibly while daydreaming about the contents of his giant mug). "It is not going to kill democracy. It is not going to stifle free expression online."
 Yummmmmm... deregulation...

Not everyone bought the assurances of the Reese's Peanut Butter Cups fan. In fact, the Attorney Generals of 22 different states announced their intention to sue the FCC over its decision.

"An open internet – and the free exchange of ideas it allows – is critical to our democratic process," New York Attorney General Eric Schneiderman noted in a press release. "The repeal of net neutrality would turn internet service providers into gatekeepers – allowing them to put profits over consumers while controlling what we see, what we do, and what we say online."

With the official publishing of Pai's order to the Federal Register happening Thursday, expect to see more lawsuits aiming to defend net neutrality hitting any day now.

Read More >>

Read More

Democrats search for 51st net neutrality vote

Senate Democrats are hunting for one more Republican vote to prevent the Federal Communications Commission (FCC) from repealing net neutrality rules.

Senate Minority Leader Charles Schumer (D-N.Y.) announced Tuesday that all 49 Democrats have endorsed legislation to preserve the rules. With Sen. Susan Collins (Maine) already on board, Democrats need the support of just one more Republican to ensure the legislation is sent to the House.

The bill, which will be introduced by Sen. Ed Markey (D-Mass.), would use a legislative tool called the Congressional Review Act (CRA) to roll back the FCC’s vote last month scrapping the 2015 net neutrality rules. The rules have required internet service providers (ISP) to treat all web traffic equally, and supporters say they’re essential to preventing companies such as Comcast and Verizon from abusing their control over internet access.The Democrats plan to use procedural rules under the CRA to force a vote on their bill in the coming months.

Even though the bill is unlikely to pass the House or be signed by President Trump, Democrats see an opportunity to capitalize on the outcry surrounding the FCC repeal and force Republicans to vote on net neutrality ahead of the midterm elections.

“With full caucus support, it’s clear that Democrats are committed to fighting to keep the internet from becoming the Wild West where ISPs are free to offer premium service to only the wealthiest customers while average consumers are left with far inferior options,” Schumer said in a statement Tuesday.

He added, “When we force a vote on this bill, Republicans in Congress will — for the first time — have the opportunity to right the administration’s wrong and show the American people whose side they’re on: big ISPs and major corporations or consumers, entrepreneurs, and small business owners.”

On the House side, Rep. Mike Doyle (D-Pa.) announced Tuesday that he had lined up 82 co-sponsors for his companion CRA bill, including House Minority Leader Nancy Pelosi (D-Calif.). But the procedural rules for CRA bills are different in the House; Democrats do not have the power to force a vote by securing co-sponsors.

That’s left the Senate as the primary venue for the net neutrality fight.

Supporters of the rules looking for the 51st vote for the CRA bill could have several targets.

Sen. John Kennedy (R-La.), for example, who made headlines last year by bucking the administration on a handful of judicial nominees, said last week that he is undecided on Markey’s bill.

“There a lot of nuances, and there are very good arguments on both sides,” Kennedy said to reporters, according to the National Journal. “I’m honestly undecided. Right now, to me, it’s a very, very close call.”

Sen. Dean Heller (R-Nev.), who’s seen as one of the most vulnerable Republicans in this year’s midterm election, is another possible target in the net neutrality push. Spokespeople for Kennedy and Heller did not respond to requests for comment.

Still, Republicans have largely opposed the Obama-era rules as heavy-handed regulation that has stifled investment from broadband companies. They say existing antitrust and consumer protection laws are already sufficient to secure an open internet.

Democrats and their allies disagree and think Republicans will pay a political price for that stance.

Fight for the Future, a group that helped rally internet users to protest the FCC vote, has already launched an online scorecard to track members’ positions on the CRA, directing supporters to reach out to their representatives.

“Net neutrality is going to be an election issue in 2018 and every member of Congress knows it,” Evan Greer, the group’s campaign director, said in a statement.

“The CRA is steamrolling through the Senate because lawmakers are reading the writing on the wall that it’s the only viable legislation on the table. Cleanly reversing the FCC’s unpopular and illegitimate decision is, on substance, the correct policy move, and the only one that has support from voters,” Greer said.

It could be months before the net neutrality bill reaches the Senate floor. The FCC’s final order still needs to receive approval from the White House’s Office of Management and Budget and must be published in the Federal Register before Congress can review it. At that point, lawmakers will have 60 legislative days to take up the CRA bills.

Even if the effort in Congress fails, as expected, the FCC’s repeal order will be facing court challenges for years to come. That will allow Democrats to extend the shelf life of a political battle in which they see themselves on the winning side.

“Republicans now have a clear choice — be on the right side of history and stand with the American people who support a free and open internet, or hold hands with the special interests who want to control the internet for their own profit,” Markey said in a statement Tuesday. “I urge them to join the majority of Americans, embrace the bipartisanship of net neutrality, and support this resolution.”

Read More >>

Read More

The FCC’s Christmas Gift to Internet Users

No doubt your Christmas would be troubled and anxiety ridden if not for this column assuring you that the Trump administration decision last week to “repeal net neutrality” does no such thing.

Net neutrality long ago became the expectation of broadband customers. It was an expectation that internet service providers routinely met during the two decades before the Obama rules were enacted. It’s an expectation they will continue to meet after the Obama rules have been withdrawn.

Net neutrality means unfiltered, unhindered access to what the web offers. Net neutrality is the business that broadband suppliers are in.

What is being repealed is a decision to recategorize broadband from a Title I to a Title II service under the 1934 Communications Act. This decision had little to do with net neutrality but meant that lobbyists and petitioners and courts would be able to pressure Washington steadily in the direction of regulating the internet the way it did the railroads in the early 1900s.

Title II is what many groups militating in the name of net neutrality really wanted. They conflated net neutrality with Title II regulation because they thought it politically expedient to do so.

Does this mean you should run screaming to the nearest cliff and throw yourself off because now the internet will be taken over by “fast lanes”?I, for one, will pass. The whole idea of fast lanes reflects a faulty, obsolete metaphor for how the internet works. The internet is more like a giant computer providing a diverse array of services to a billion-plus users simultaneously.

It delivers you a webpage, me a video. In the future, it will help your driverless car navigate traffic, a doctor examine and treat an injury remotely. It will make sure your refrigerator is full of beer.

The businesses supplying each of these services care only that their own customers are happy. Their customers care only that their own service is satisfactory. They won’t care or even notice that the computer is constantly optimizing its performance so its diverse users are all kept simultaneously happy.

The whole “fast lane” nonsense is even more nonsense when we realize how much it’s the efforts of so-called edge providers that determine service quality. If a static webpage doesn’t load as quickly as you might wish, today it’s because of slow servers among the dozens that nowadays contribute pieces of a webpage. Not to blame usually is the last-mile carrier, who’s moving these elements to you as fast as content suppliers make them available.

Or take Netflix: It spends millions to place servers containing its shows inside the systems of last-mile providers to improve delivery and reduce transport costs.

Laws against fraud and anticompetitive behavior apply to broadband suppliers as they do to other companies in the economy. If a supermarket sells you a can of dirt labeled “peas,” it would not long stay in business. But, wait, aren’t we in a uniquely bad position because so many of us have only one or two choices for broadband at home?

All businesses would like to charge an infinitely high price for infinitely chintzy service, but not even Comcast can get away with this, even when competition is inadequate, because customers have voices and politicians and regulators listen to those voices. And competition can only improve matters.

Ironically, what consistently outrages the net-neut freaks is the wireless sector, where competition is fierce, and where rivals dangle offers of uncapped streaming from certain video services, and even free Netflix or Sling TV. This offends sacred principle, never mind that it increasingly turns wireless into a plausible substitute for the local fixed-line monopolist.

Verizon, AT&T, Sprint and T-Mobile—all have made announcements, and put money behind them, promising that 5G wireless will render the local cable oligopoly a thing of the past. Repealing Title II not only makes such investment attractive. It will enable wireless to support a whole slew of advanced services while keeping customers maximally happy.

Disney last week announced it would spend $52.4 billion to acquire certain Fox assets to replicate Netflix’s business model. Notice that Netflix’s business model is premised entirely on the existence of ubiquitous, affordable, unhindered broadband.

Ajit Pai, chairman of the Federal Communications Commission, is the Santa, not the Grinch, of this holiday season. Repeal of Title II is what will make the future internet possible. It’s just too bad those net-neutrality obsessives piling up lifelessly at the bottom of the nearest cliff won’t be around to enjoy it.

Read More >>

Read More

Government-forced 'net neutrality': Putting future inventors between a rock and a hard place

One of my favorite Greek Myths is Sisyphus, an arrogant king who earned a terrible punishment by trying to cheat death: he was forced to roll a rock pointlessly up a hill, only to watch it roll back down every time, for all of time.

Fast forward to modern times, and the debate surrounding “net neutrality” very much feels like my rock. We make a move in the right direction — taking a hands-off regulatory approach to the Internet — but then leftist activists swoop in, and try to throw shackles on the Internet.

Armed with their good old playbook, these activists have declared war and are unapologetic in their efforts to spread mistruths that will hopefully trick enough people into believing that burdensome overregulation of the Internet is our only choice. Instead of commonsense and transparency, they opt for radical ideological warfare.

One point to clarify is that these pretend consumer advocates are not on their white horses, brandishing their swords and shields, to save your “free and open Internet.” That is what they desperately want you to believe.

The activists are supporters of the deceptively titled “net neutrality," which treats Internet service providers as public utilities, like electric companies. Net neutrality is not neutral at all. It would appoint a bureaucrat to play referee over the Internet, which it doesn’t need, but even worse, that referee would only call fouls on one team. That means that it is nearly impossible (Greek mythology-type impossible) for net neutrality to bring down costs.

Their efforts now focus on protecting a set of 2015 rules put in place by former President Barack Obama and his Federal Communications Commission known as Title II, which classifies Internet service providers as public utilities, like electricity, gas, and water. That is the contentious point in this debate, not the issue of a free and open Internet.

These groups are raising an all-out policy war and kicking dust in the air because of the current FCC’s intent to reverse this crippling 2015 rule, which not only prioritizes certain companies over others but it also manipulates the very foundation of how our nation’s markets work.

The irrefutable economic truth is that more regulation like Title II equals more costs and less innovation.

A market doesn’t become more efficient when a bureaucrat tries to step in and dictate how decisions are to be made and how a market/service/transaction is going to run. That kind of meddling always slows things down, both Internet speeds and innovation, because even if a better solution is found, old regulations can stifle the marketplace and hurt consumers. Think of the way taxi unions have tried to stop ride-share programs like Uber and Lyft.

For example, this trend can be seen in markets from TVs to college, as this Bureau of Labor Statistics chart wonderfully illustrates.

Armed with their good old playbook, these activists have declared war and are unapologetic in their efforts to spread mistruths that will hopefully trick enough people into believing that burdensome overregulation of the Internet is our only choice. Instead of commonsense and transparency, they opt for radical ideological warfare.

One point to clarify is that these pretend consumer advocates are not on their white horses, brandishing their swords and shields, to save your “free and open Internet.” That is what they desperately want you to believe.

The activists are supporters of the deceptively titled “net neutrality," which treats Internet service providers as public utilities, like electric companies. Net neutrality is not neutral at all. It would appoint a bureaucrat to play referee over the Internet, which it doesn’t need, but even worse, that referee would only call fouls on one team. That means that it is nearly impossible (Greek mythology-type impossible) for net neutrality to bring down costs.

Their efforts now focus on protecting a set of 2015 rules put in place by former President Barack Obama and his Federal Communications Commission known as Title II, which classifies Internet service providers as public utilities, like electricity, gas, and water. That is the contentious point in this debate, not the issue of a free and open Internet.

These groups are raising an all-out policy war and kicking dust in the air because of the current FCC’s intent to reverse this crippling 2015 rule, which not only prioritizes certain companies over others but it also manipulates the very foundation of how our nation’s markets work.

The irrefutable economic truth is that more regulation like Title II equals more costs and less innovation.

A market doesn’t become more efficient when a bureaucrat tries to step in and dictate how decisions are to be made and how a market/service/transaction is going to run. That kind of meddling always slows things down, both Internet speeds and innovation, because even if a better solution is found, old regulations can stifle the marketplace and hurt consumers. Think of the way taxi unions have tried to stop ride-share programs like Uber and Lyft.

For example, this trend can be seen in markets from TVs to college, as this Bureau of Labor Statistics chart wonderfully illustrates.

The trend is obvious, but many on the left still think they can regulate an industry into submission. They can use the stick instead of the carrot to encourage innovation and competition. Markets just don’t work that way.

Regulation is an extra constraint, and the way to create more innovation is to eliminate constraints. In a lot of ways, that is the way that the Internet currently functions. The Internet catapulted us into the future because Internet providers and Silicon Valley were not hamstrung by excessive extortion: taxes, regulation, and unionization. Silicon Valley exploded because its barons followed Atlas Shrugged, not Haight-Ashbury.

In the lead up to a potential December vote on restoring Internet freedom at the FCC’s open meeting, there has been an uptick in events, congressional hearings, and commentary. While it’s no surprise that debate continues on the merits of Title II, the FCC needs to look one step further. If it really wants to restore and preserve Internet freedom, it needs a national framework to pre-empt a patchwork framework in the states, which is where the leftist activists will go next to try to get wins.

Sisyphus’s action of rolling his rock make sense, at least in the context of Greek Mythology. It’s his punishment. But this isn’t ancient Greece, and U.S. tech innovators shouldn’t be punished in similar fashion.

The leftist activist support of slow government bureaucracy to foster innovation from the Internet doesn’t make any sense. I guess, unless, they are trying to cheat the laws of economics. That might not be as punishable as cheating death, but maybe they should be “punished” by being forced to read Ludwig Von Mises' Human Action only to return to the riveting beginning of the economic page-turner when they are done.

A punishment for sure, but one which will likely lead to something greater: a faster, cheaper, less-regulated Internet.

Charles Sauer (@CharlesSauer) is a contributor to the Washington Examiner's Beltway Confidential blog. He is president of the Market Institute and previously worked on Capitol Hill, for a governor, and for an academic think tank.
Read More >>

Read More

The Petya ransomware is starting to look like a cyberattack in disguise

The ransomware that wasn’t

The haze of yesterday’s massive ransomware attack is clearing, and Ukraine has already emerged as the epicenter of the damage. Kaspersky Labs reports that as many as 60 percent of the systems infected by the Petya ransomware were located within Ukraine, far more than anywhere else. The hack’s reach touched some of the country’s most crucial infrastructure including its central bank, airport, metro transport, and even the Chernobyl power plant, which was forced to move radiation-sensing systems to manual.

The ostensible purpose of all that damage was to make money — and yet there’s very little money to be found. Most ransomware flies under the radar, quietly collecting payouts from companies eager to get their data back and decrypting systems as payments come in. But Petya seems to have been incapable of decrypting infected machines, and its payout method was bizarrely complex, hinging on a single email address that was shut down almost as soon as the malware made headlines. As of this morning, the Bitcoin wallet associated with the attack had received just $10,000, a relatively meager payout by ransomware standards.

“THERE’S NO FUCKING WAY THIS WAS CRIMINALS.”
It leads to an uncomfortable question: what if money wasn’t the point? What if the attackers just wanted to cause damage to Ukraine? It’s not the first time the country has come under cyberattack. (These attacks have typically been attributed to Russia.) But it would be the first time such an attack has come in the guise of ransomware, and has spilled over so heavily onto other countries and corporations.

Because the virus has proven unusually destructive in Ukraine, a number of researchers have come to suspect more sinister motives at work. Peeling apart the program’s decryption failure in a post today, Comae’s Matthieu Suiche concluded a nation state attack was the only plausible explanation. “Pretending to be a ransomware while being in fact a nation state attack,” Suiche wrote, “ is in our opinion a very subtle way from the attacker to control the narrative of the attack.”

Another prominent infosec figure put it more bluntly: “There’s no fucking way this was criminals.”


There’s already mounting evidence that Petya’s focus on Ukraine was deliberate. The Petya virus is very good at moving within networks, but initial attacks were limited to just a few specific infections, all of which seem to have been targeted at Ukraine. The highest-profile one was a Ukrainian accounting program called MeDoc, which sent out a suspicious software update Tuesday morning that many researchers blame for the initial Petya infections. Attackers also planted malware on the homepage of a prominent Ukraine-based news outlet, according to one researcher at Kaspersky.

THE INFECTIONS SEEM TO TARGET UKRAINE’S MOST VITAL INSTITUTIONS
In each case, the infections seem to specifically target Ukraine’s most vital institutions, rather than making a broader attempt to find lucrative ransomware targets. These initial infections are particularly telling because they were directly chosen by whoever set the malware in motion. Computer viruses often spread farther than their creators intended, but once Petya was on the loose, the attackers would have had no control over how far it reached. But the attackers had complete control over where they planted Petya initially, and they chose to plant it by some of the most central institutions in Ukraine.

The broader political context makes Russia a viable suspect. Russia has been engaged in active military interventions in Ukraine since former president Viktor Yanukovych was removed from power in 2014. That has included the annexation of Crimea and the active movement of troops and equipment in the eastern region of the country, but also a number of more subtle activities. Ukraine’s power grid came under cyberattack in December 2015, an attack many interpreted as part of a hybrid attack by Russia against the country’s infrastructure. That hybrid-warfare theory extends to more conventional guerrilla attacks: the same day that Petya ripped through online infrastructure, Ukrainian colonel Maksim Shapoval was killed by a car bomb attack in Kiev.

“I THINK ULTIMATELY IT’S ABOUT MONEY.”
All that evidence is still circumstantial, and there’s no hard link between yesterday’s attacks and any nation state. It could be Ukraine simply presented a soft target, and the attackers screwed up their payment and decryption systems out of simple carelessness. Functional or not, the software involved still has strong ties to traditional ransomware systems, and even if the attackers didn’t make much money off ransom payments, Petya was still collecting credentials and other data from infected machines, which could be valuable fodder for future attacks. That has led researchers like F-Secure’s Sean Sullivan to hold off on nation-state suspicions. “Maybe there’s multiple ways they’re working the money angle, but I think ultimately it’s about money,” Sullivan told me. “Tigers don’t change their stripes.”

Still, the line between common criminals and state agents can be difficult to parse. A recent indictment in the Yahoo hacking case charged Russian officials alongside freelance hackers, and the division of labor was often unclear. Criminals can be enlisted as privateers, or agents can adopt criminal tactics as a way of disguising themselves. If the suspicions around Petya are correct, that line may be growing even thinner, as globe-spanning attacks get lost in the fog of war. With no clear path to a firm attribution, we may never be able to prove who was responsible for this week’s attacks, or what they hoped to achieve. For anyone digging out a Petya-bricked computer system, that clean getaway is adding insult to injury.The haze of yesterday’s massive ransomware attack is clearing, and Ukraine has already emerged as the epicenter of the damage. Kaspersky Labs reports that as many as 60 percent of the systems infected by the Petya ransomware were located within Ukraine, far more than anywhere else. The hack’s reach touched some of the country’s most crucial infrastructure including its central bank, airport, metro transport, and even the Chernobyl power plant, which was forced to move radiation-sensing systems to manual.

The ostensible purpose of all that damage was to make money — and yet there’s very little money to be found. Most ransomware flies under the radar, quietly collecting payouts from companies eager to get their data back and decrypting systems as payments come in. But Petya seems to have been incapable of decrypting infected machines, and its payout method was bizarrely complex, hinging on a single email address that was shut down almost as soon as the malware made headlines. As of this morning, the Bitcoin wallet associated with the attack had received just $10,000, a relatively meager payout by ransomware standards.

“THERE’S NO FUCKING WAY THIS WAS CRIMINALS.”
It leads to an uncomfortable question: what if money wasn’t the point? What if the attackers just wanted to cause damage to Ukraine? It’s not the first time the country has come under cyberattack. (These attacks have typically been attributed to Russia.) But it would be the first time such an attack has come in the guise of ransomware, and has spilled over so heavily onto other countries and corporations.

Because the virus has proven unusually destructive in Ukraine, a number of researchers have come to suspect more sinister motives at work. Peeling apart the program’s decryption failure in a post today, Comae’s Matthieu Suiche concluded a nation state attack was the only plausible explanation. “Pretending to be a ransomware while being in fact a nation state attack,” Suiche wrote, “ is in our opinion a very subtle way from the attacker to control the narrative of the attack.”

Another prominent infosec figure put it more bluntly: “There’s no fucking way this was criminals.”


There’s already mounting evidence that Petya’s focus on Ukraine was deliberate. The Petya virus is very good at moving within networks, but initial attacks were limited to just a few specific infections, all of which seem to have been targeted at Ukraine. The highest-profile one was a Ukrainian accounting program called MeDoc, which sent out a suspicious software update Tuesday morning that many researchers blame for the initial Petya infections. Attackers also planted malware on the homepage of a prominent Ukraine-based news outlet, according to one researcher at Kaspersky.

THE INFECTIONS SEEM TO TARGET UKRAINE’S MOST VITAL INSTITUTIONS
In each case, the infections seem to specifically target Ukraine’s most vital institutions, rather than making a broader attempt to find lucrative ransomware targets. These initial infections are particularly telling because they were directly chosen by whoever set the malware in motion. Computer viruses often spread farther than their creators intended, but once Petya was on the loose, the attackers would have had no control over how far it reached. But the attackers had complete control over where they planted Petya initially, and they chose to plant it by some of the most central institutions in Ukraine.

The broader political context makes Russia a viable suspect. Russia has been engaged in active military interventions in Ukraine since former president Viktor Yanukovych was removed from power in 2014. That has included the annexation of Crimea and the active movement of troops and equipment in the eastern region of the country, but also a number of more subtle activities. Ukraine’s power grid came under cyberattack in December 2015, an attack many interpreted as part of a hybrid attack by Russia against the country’s infrastructure. That hybrid-warfare theory extends to more conventional guerrilla attacks: the same day that Petya ripped through online infrastructure, Ukrainian colonel Maksim Shapoval was killed by a car bomb attack in Kiev.

“I THINK ULTIMATELY IT’S ABOUT MONEY.”
All that evidence is still circumstantial, and there’s no hard link between yesterday’s attacks and any nation state. It could be Ukraine simply presented a soft target, and the attackers screwed up their payment and decryption systems out of simple carelessness. Functional or not, the software involved still has strong ties to traditional ransomware systems, and even if the attackers didn’t make much money off ransom payments, Petya was still collecting credentials and other data from infected machines, which could be valuable fodder for future attacks. That has led researchers like F-Secure’s Sean Sullivan to hold off on nation-state suspicions. “Maybe there’s multiple ways they’re working the money angle, but I think ultimately it’s about money,” Sullivan told me. “Tigers don’t change their stripes.”


Still, the line between common criminals and state agents can be difficult to parse. A recent indictment in the Yahoo hacking case charged Russian officials alongside freelance hackers, and the division of labor was often unclear. Criminals can be enlisted as privateers, or agents can adopt criminal tactics as a way of disguising themselves. If the suspicions around Petya are correct, that line may be growing even thinner, as globe-spanning attacks get lost in the fog of war. With no clear path to a firm attribution, we may never be able to prove who was responsible for this week’s attacks, or what they hoped to achieve. For anyone digging out a Petya-bricked computer system, that clean getaway is adding insult to injury.

Read More >>

Read More

Cyberattack Hits Ukraine Then Spreads Internationally

Several companies have been affected by the Petya cyberattack, including, from left, Rosneft, the Russian energy giant; Merck, a pharmaceutical company; and Maersk, a shipping company. Credit Left, Sergei Karpukhin/Reuters; center, Matt Rourke/Associated Press; right, Enrique Castro Sanchez/Agence France-Presse — Getty Images

Computer systems from Ukraine to the United States were struck on Tuesday in an international cyberattack that was like a recent assault that crippled tens of thousands of machines worldwide.

In Kiev, the capital of Ukraine, A.T.M.s stopped working. About 80 miles away, workers were forced to manually monitor radiation at the old Chernobyl nuclear plant when their computers failed. And tech managers at companies around the world, from Maersk, the Danish shipping conglomerate, to Merck, the drug giant in the United States, were scrambling to respond.

It was unclear who was behind this cyberattack, and the extent of its impact was still hard to gauge Tuesday. It started as an attack on Ukrainian government and business computer systems — an assault that appeared to have been intended to hit the day before a holiday marking the adoption in 1996 of Ukraine’s first Constitution after breaking away from the Soviet Union. It spread from there, causing collateral damage around the world.

This outbreak is the latest and perhaps the most sophisticated in a series of attacks that make use of dozens of hacking tools that were stolen from the National Security Agency and leaked online in April by a group called the Shadow Brokers.

Like the WannaCry attacks in May, the latest global hacking took control of computers and demanded digital ransom from their owners to regain access. The new attack used the same N.S.A. hacking tool, Eternal Blue, that was used in the WannaCry incident, and two other methods to promote its spread, according to researchers at the computer security company Symantec.

The N.S.A. has not acknowledged its tools were used in WannaCry or other attacks. But computer security specialists are demanding that the agency help the rest of the world defend against the weapons it created.

”The N.S.A. needs to take a leadership role in working closely with security and operating system platform vendors such as Apple and Microsoft to address the plague that they’ve unleashed,” said Golan Ben-Oni, the global chief information officer at IDT, a Newark-based conglomerate hit by a separate attack in April that used N.S.A. hacking tools. Mr. Ben-Oni warned federal officials that more serious attacks were probably on the horizon.

The vulnerability in Windows software used by Eternal Blue was patched by Microsoft in March, but as the WannaCry attacks demonstrated, hundreds of thousands of organizations around the world failed to properly install the fix.

“Just because you roll out a patch doesn’t mean it’ll be put in place quickly,” said Carl Herberger, vice president of security at Radware. “The more bureaucratic an organization is, the higher chance it won’t have updated its software.”

Because the ransomware used at least two other ways to spread on Tuesday, even those who used the Microsoft patch could be vulnerable, according to researchers at F-Secure, the Finnish cybersecurity firm.

A Microsoft spokesman said the company’s latest antivirus software should protect against the attack.

The Ukrainian government said several of its ministries, local banks and metro systems had been affected. A number of other European companies, including Rosneft, the Russian energy giant; Saint-Gobain, the French construction materials company; and WPP, the British advertising agency, also said they had been targeted.

Ukrainian officials pointed a finger at Russia on Tuesday, though Russian companies were also affected. Home Credit bank, one of Russia’s top 50 lenders, was paralyzed, with all of its offices closed, according to the RBC news website. The attack also affected Evraz, a steel manufacturing and mining company that employs about 80,000 people, the RBC website reported.

In the United States, DLA Piper, the multinational law firm, also reported being hit. Hospitals in Pennsylvania were being forced to cancel surgeries after the attack hit computers at Heritage Valley Health Systems, a Pennsylvania health care provider, and its hospitals in Beaver and Sewickley, Penn., and satellite locations across the state.

A spokesman for the N.S.A. referred questions about the attack to the Department of Homeland Security. “The Department of Homeland Security is monitoring reports of cyber attacks affecting multiple global entities and is coordinating with our international and domestic cyber partners,” Scott McConnell, spokesman for D.H.S., said in a statement.

Computer specialists said the ransomware was very similar to a virus that first emerged last year called Petya. Petya means “Little Peter,” in Russian, leading some to speculate the name referred to Sergei Prokofiev’s 1936 symphony “Peter and the Wolf,” about a boy who captures a wolf.

Reports that the computer virus was a variant of Petya suggest the attackers will be hard to trace. Petya was for sale on the so-called dark web, where its creators made the ransomware available as “ransomware as a service” — a play on Silicon Valley terminology for delivering software over the internet, according to the security firm Avast Threat Labs.

That means anyone could launch the ransomware with the click of a button, encrypt someone’s systems and demand a ransom to unlock it. If the victim pays, the authors of the Petya ransomware, who call themselves Janus Cybercrime Solutions, get a cut of the payment.

That distribution method means that pinning down the people responsible for Tuesday’s attack could be difficult.

The attack is “an improved and more lethal version of WannaCry,” according to Matthieu Suiche, a security researcher who helped contain the spread of the WannaCry ransomware when he created a kill switch that stopped the attacks.

In just the last seven days, Mr. Suiche noted that WannaCry had tried to hit an additional 80,000 organizations, but was prevented from executing attack code because of the kill switch. Petya does not have a kill switch.

A screenshot of what appeared to be the ransomware affecting systems worldwide on Tuesday. The Ukrainian government posted the shot to its official Facebook page.

Petya also encrypts and locks entire hard drives, while the earlier ransomware attacks locked only individual files, said Chris Hinkley, a researcher at Armor, the security firm.

The hackers behind Petya demanded $300 worth of the cybercurrency Bitcoin to unlock victims’ machines. By Tuesday afternoon, online records showed that 30 victims had paid the ransom, though it was not clear whether they regained access to their files. Other victims may be out of luck, after Posteo, the German email service provider, shut down the hackers’ email account.

In Ukraine, people turned up at post offices, A.T.M.s and airports to find blank computer screens, or signs about closures. At Kiev’s central post office, a few bewildered customers milled about, holding parcels and letters, looking at a sign that said, “closed for technical reasons.”

The hackers compromised Ukrainian accounting software mandated to be used in various industries in the country, including government agencies and banks, according to researchers at Cisco Talos, the security division of the computer networking company. That allowed them to unleash their ransomware when the software, which is also used in other countries, was updated.

The ransomware spread for five days across Ukraine, and around the world, before activating Tuesday evening.

“If I had to guess, I would think this was done to send a political message,” said Craig Williams, the senior technical researcher at Talos.

One Kiev resident, Tetiana Vasylieva, was forced to borrow money from a relative after failing to withdraw money at four automated teller machines. At one A.T.M. in Kiev belonging to the Ukrainian branch of the Austrian bank Raiffeisen, a message on the screen said the machine was not functioning.

Ukraine’s Infrastructure Ministry, the postal service, the national railway company, and one of the country’s largest communications companies, Ukrtelecom, had been affected, Volodymyr Omelyan, the country’s infrastructure minister, said in a Facebook post.

Officials for the metro system in Kiev said card payments could not be accepted. The national power grid company Kievenergo had to switch off all of its computers, but the situation was under control, according to the Interfax-Ukraine news agency. Metro Group, a German company that runs wholesale food stores, said its operations in Ukraine had been affected.

At the Chernobyl plant, the computers affected by the attack collected data on radiation levels and were not connected to industrial systems at the site, where, though all reactors have been decommissioned, huge volumes of radioactive waste remain. Operators said radiation monitoring was being done manually.

Cybersecurity researchers questioned whether collecting ransom was the true objective of the attack.

“It’s entirely possible that this attack could have been a smoke screen,” said Justin Harvey, the chief security officer for the Fidelis cybersecurity company. “If you are an evil doer and you wanted to cause mayhem, why wouldn’t you try to first mask it as something else?”

Read More >>

Read More

Global Cyberattack: What We Know and Don’t Know

A screenshot of what appeared to be the ransomware affecting systems worldwide on Tuesday. The Ukrainian government posted the shot to its official Facebook page.

A quickly spreading ransomware attack is hitting countries across the world including France, Russia, Spain, Ukraine and the United States, just weeks after a ransomware attack known as WannaCry.

What We Know

• Several private companies have confirmed that they were hit by the attack, including the American pharmaceutical giant Merck, the Danish shipping company AP Moller-Maersk, the British advertising firm WPP, the French multinational Saint-Gobain and the Russian steel, mining and oil companies Evraz and Rosneft.

• Photographs and videos of computers affected by the attack show a message of red text on a black screen. The message read: “Oops, your important files have been encrypted. If you see this text then your files are no longer accessible because they have been encrypted. Perhaps you are busy looking to recover your files but don’t waste your time.”

• Kaspersky Lab, a cybersecurity firm based in Moscow, reported that about 2,000 computer systems had been affected by the new ransomware.

• Cybersecurity researchers first called the new ransomware attack Petya, as it bore similarities to a ransomware strain known by that name, which was first reported by Kasperksy in March 2016. But Kaspersky later said that its investigation into the new attack found that it was a type of ransomware that had never been seen before.

• ESET, a Slovakia-based cybersecurity company, said the first known infection occurred early on June 27, through a Ukrainian software company called MeDoc. MeDoc denied that its program was the initial infection point. In a Facebook post, the firm wrote, “At the time of updating the program, the system could not be infected with the virus directly from the update file,” though an earlier message confirmed that its systems had been compromised.

• Symantec, a Silicon Valley cybersecurity firm, confirmed that the ransomware was infecting computers through at least one exploit, or vulnerability to computer systems, known as Eternal Blue.

• Eternal Blue was leaked online last April by a mysterious group of hackers known as the Shadow Brokers, who have previously released hacking tools used by the National Security Agency. That vulnerability was used in May to spread the WannaCry ransomware, which affected hundreds of thousands of computers in more than 150 countries.

• ESET and several other cybersecurity companies have identified at least one other exploit used in the attack known as PsExec, which takes advantage of a single computer that has not been updated with the latest software in a network to spread infections by looking for — and using — administrative credentials. By using PsExec, the ransomware continued spreading across systems that had been updated, or patched, after the WannaCry outbreak last month.

• Several cybersecurity researchers have identified a Bitcoin address to which the attackers are demanding a payment of $300 from their victims. At least some of the victims appear to be paying the ransom, even though the email address used by the attackers has been shut down. That removes the possibility that the attackers could restore a victim’s access to their computer networks, even once ransom is paid.

What We Don’t Know

• Who is behind the ransomware attack. The original Petya ransomware was developed and used by cybercriminals, and variations have been sold through dark web trading sites, which are accessible only by using browsers that mask a user’s identity, making it difficult for cybersecurity researchers to track.

• The motives for the attack. Cybersecurity researchers ask why, if the goal of the attack was to force victims to pay ransom, more care was not taken to protect the email address through which attackers could communicate with their victims, or to provide multiple avenues for payment.

• How much bigger this attack will get. Cybersecurity researchers say that like WannaCry, the ransomware infects computers using vulnerabilities in the central nerve of a computer, called a kernel, making it difficult for antivirus firms to detect. It also has the ability to take advantage of a single unpatched computer on a network to infect computers across a vast network, meaning that even systems that were updated after WannaCry could potentially become vulnerable again.

What Is Ransomware?

• Ransomware is one of the most popular forms of online attack today. It typically begins with attackers sending their victims email that includes a link or a file that appears innocuous but contains dangerous malware.

• Once a victim clicks on the link or opens the attachment, the computer becomes infected. The program encrypts the computer, essentially locking the user out of files, folders and drives on that computer. In some cases, the entire network the computer is connected to can become infected.

• The victim then receives a message demanding payment in exchange for attackers unlocking the system. The payment is usually requested in Bitcoin, a form of digital currency.

Read More >>

Read More

Tumblr Goes Radio Silent On Net Neutrality After Verizon Acquisition

Back when Verizon first began expressing interest in pivoting from broadband duopolist to media and advertising, you might recall that it launched a short-lived technology blog named Sugarstring. Sugarstring quickly made headlines for all the wrong reasons however, after it was revealed that Verizon was banning any new hires from writing about hot-button subjects like net neutrality, or the fact that companies like Verizon and AT&T are now bone-grafted to the nation's intelligence and surveillance apparatus.

Sugarstring is long-since dead, replaced in large part by Verizon's acquisitions of Yahoo and AOL, which also brought Huffpo, Engadget, and Techcrunch under the Verizon umbrella. And while Verizon itself has been busy using fake reporters to blatantly lie about the company's ongoing role in killing net neutrality, there's no indication (yet) that the company has pressured any of its own news outlets to quiet down on the subject. In fact, we've noted previously that some of the best reporting on net neutrality in recent months has originated at TechCrunch (this piece in particular is worth a read).
But while Verizon hasn't yet tried to get its own news outlets to quiet down on net neutrality, other now-Verizon-owned companies that used to be very active on the subject have gone dead quiet. Case in point: Tumblr, which was an integral ally in the SOPA/PIPA fight and an outspoken protector of net neutrality, is now utterly radio silent as FCC boss Ajit Pai attempts to kill the popular consumer protections. Insiders at the company this week expressed their concern to the Verge that Verizon is pressuring CEO David Karp to keep his mouth shut on the subject:

"Now, multiple sources tell The Verge that employees are concerned that Karp has been discouraged from speaking publicly on the issue, and one engineer conveyed that Karp told a group of engineers and engineering directors as much in a weekly meeting that took place shortly after SXSW. “Karp has talked about the net neutrality stuff internally, but won’t commit to supporting it externally anymore,” the engineer said. “[He] assures [us] that he is gonna keep trying to fight for the ability to fight for it publicly.” Karp did not respond to four emails asking for comment, and neither Yahoo nor Tumblr would speak about the matter on the record."

Granted Karp may just have toned down the company's rhetoric voluntarily to avoid ruffling feathers during the transition. And obviously any time a smaller company gets acquired by a larger conglomerate (especially from the historically droll and stodgy telecom sector) you'll see a major culture shift that often isn't for the better. Still, Verizon's positions on subjects like net neutrality are so hostile, Tumblr employees have grown increasingly uneasy in recent weeks, which could lead to an exodus of talent at the company:

“Some of our previous stances on issues that are really important to Tumblr employees and its community are being silenced,” said the former employee. “We've been really noisy about things like net neutrality in the past. We asked the new Head, Simon Khalaf, about it in an all-hands a few weeks ago and he said it was ‘not his problem’ and ‘above his pay grade.’” A current employee and another former employee corroborated this account."
It's unfortunate to have lost Tumblr's voice in the net neutrality fight, especially given that other industry giants like Google and Netflix have similarly gone mute on the subject, leaving consumers and small businesses increasingly alone in fighting for something vaguely resembling an open and healthy internet. And while you'd like to think Verizon is above trampling the editorial independence of former AOL and Yahoo news outlets, Verizon's Sugarstring experiment should make it pretty clear that ham-fisted attempts at censorship aren't exactly out of character for the telco.

For now, however, Verizon appears content to try and use entirely fake journalists like "Jeremy" to spread misinformation on net neutrality, as evident by this recent, comically misleading video by the company:

Read More >>

Read More

Net Neutrality Is Dying. Speak Out Now Before It's Too Late

“Come on! The internet is an incredible place!” said comedian and political commentator John Oliver, “And tonight, we need to talk about an issue that is impacting it.” He was just one of the many advocates of a free and open internet who were using the public forum to spread awareness on the threats that the internet is about to face. On May 18, 2017, the current Federal Communications Commission (FCC) led by Chairman Ajit Pai voted 2-1 on a motion to repeal rules and regulations put in place by his predecessor to ensure a free and open internet for all.

The motion, if sustained during a second vote held after the FCC is fully staffed later this year, would mean the repelation of the so-called net neutrality regulations that were put into place by retired FCC Chairman Tom Wheeler to ensure that internet service providers like Comcast, AT&T and Verizon cannot discriminate against various types of internet traffic in a way that suits their businesses. This would give popular broadband companies and internet service providers greater monopoly in their services, allowing them to regulate and alter the people’s access to the internet in a way that suits their needs.

The question of net neutrality is a rather big one, and significantly more important than being able to decide what streaming service you want to use or what search engine you wish to access, though that alone should be incentive enough to speak up. If the proposal put forward by FCC Chairman Ajit Pai falls into place, it would allow internet service providers to block, throttle and fast-lane various parts of the internet at will, potentially regulating and censoring your entire web-surfing experience and forcing you to stick to the destinations that pay protection money to these cable and broadband companies. It would effectively lead to the monopolization of a free institution that since the 1980s has served as the freest and most democratic source of unbridled information.

It is only rarely that we get to see big corporations the likes of Google and Facebook take up the cause of ordinary citizens on a massive scale, but when we do, it is assured that the matter at hand is an important one. When it came to net neutrality, however, we saw our entire country, rich, poor, democrat, republican, independent and corporate, come together to support an idea that is necessary for the growth and prosperity of our data nation as a whole. That is because net neutrality is an idea that anyone can get behind, one that promotes free and equal access to information for every citizen of the country, and initiative that is not only desirable but also essential for the growth of our country and the entire world from an information perspective.

Thankfully for us, the fight isn’t over yet. A huge number of organizations, small and large, are coming together on July 12 to protest the current administration's blatant disregard of public opinion in their decision to break net neutrality, and it is the hope of these participants that, with the correct amount of attention, they can force the government to take notice regarding an issue that should clearly be independent and bipartisan, much like climate change and affordable healthcare.

If you or anyone you know considers themselves an informed citizen of the country and of the internet, one that is prepared to fight for its freedom and in turn, the freedom of the people, I request you to join now by signing up at this website to participate in the massive protest being held on July 12 to demonstrate our apartisan love for net neutrality and the principles that govern it. Remember, the only thing necessary for the triumph of evil is for good men to do nothing.

Read More >>

Read More

Netflix Joins Support of Net Neutrality

July 12 will be a national day of action for net neutrality, and Netflix has finally announced it will be fully participating.

During the Obama years, Netflix was a major player on the front lines of the fight for ensuring net neutrality. As a streaming service, Netflix theoretically relies on net neutrality to ensure internet providers don’t slow down their streaming speed in order to elevate cable programs.

But Netflix hasn’t seemed to be as enthusiastic as of late, even as the FCC under Ajit Pai, a former cable lobbyist appointed by Trump, poses the most grave threat to net neutrality we’ve ever seen.

Netflix CEO Reed Hastings recently said, “We think net neutrality is incredibly important, [but] not narrowly important to us because we’re big enough to get the deals we want.”


This raised concerns that Netflix had grown too big for it’s britches and that the fight for net neutrality had lost one of its most powerful forces.

But a few days ago, Netflix released another statement saying, “Netflix will never outgrow the fight for net neutrality. Everyone deserves an open Internet.” A Netflix spokesperson also added, “”We support strong net neutrality protections, even if we are at less risk because of our popularity. There are other companies for whom this is a bigger issue, and we’re joining this day of action to ensure the next Netflix has a fair shot to go the distance.”

Some have said that Netflix’s response was just a PR ploy and they’re just doing this to save face because of growing public pressure. That may be true, but ultimately it doesn’t matter. It’s great that there’s enough public zeal out there to put pressure on companies, and it’s great that Netflix has reaffirmed its position regardless of their motive.

Maybe Netflix really is big enough now to have sufficient negotiating power to take care of themselves when it comes to streaming speeds and dealing with ISPs. But the internet-based video streaming industry as a whole needs net neutrality and would be one of the hardest hit mediums if Pai and cable providers have their way.

Without net neutrality, cable providers can prioritize cable TV in ways that will attempt to deter people from using various online video streaming platforms. Imagine going to Youtube, Amazon or Netflix and seeing a message saying something along the lines of, “To access this site you must pay $5.99/month access fee to your internet provider. If you would like to be able to stream without buffering for 10 minutes or more, an additional $2 fee will be added for each video.”

It’s impossible to overstate the importance of the what’s going on with net neutrality right now. Regardless of what you think of Netflix, it’s a huge relief to have them, and all their lobbying resources, in the fight.

Read More >>

Read More

The United Nations has a radical, dangerous vision for the future of the Web

It may not have intended to, precisely, but the United Nations just took sides in the Internet’s most brutal culture war.

On Thursday, the organization’s Broadband Commission for Digital Development released a damning “world-wide wake-up call” on what it calls “cyber VAWG,” or violence against women and girls. The report concludes that online harassment is “a problem of pandemic proportion” — which, nbd, we’ve all heard before.

But the United Nations then goes on to propose radical, proactive policy changes for both governments and social networks, effectively projecting a whole new vision for how the Internet could work.

Under U.S. law — the law that, not coincidentally, governs most of the world’s largest online platforms — intermediaries such as Twitter and Facebook generally can’t be held responsible for what people do on them. But the United Nations proposes both that social networks proactively police every profile and post, and that government agencies only “license” those who agree to do so.

“The respect for and security of girls and women must at all times be front and center,” the report reads, not only for those “producing and providing the content,” but also everyone with any role in shaping the “technical backbone and enabling environment of our digital society.”

How that would actually work, we don’t know; the report is light on concrete, actionable policy. But it repeatedly suggests both that social networks need to opt-in to stronger anti-harassment regimes and that governments need to enforce them proactively.

At one point toward the end of the paper, the U.N. panel concludes that “political and governmental bodies need to use their licensing prerogative” to better protect human and women’s rights, only granting licenses to “those Telecoms and search engines” that “supervise content and its dissemination.”


In other words, the United Nations believes that online platforms should be (a) generally responsible for the actions of their users and (b) specifically responsible for making sure those people aren’t harassers.

Regardless of whether you think those are worthwhile ends, the implications are huge: It’s an attempt to transform the Web from a libertarian free-for-all to some kind of enforced social commons.

This question, of course, mirrors other, larger debates playing out across the culture, including tiffs over academic “trigger warnings” and debates about Reddit’s foggy future. Writing at Breitbart several weeks ago, the conservative columnist Allum Bokhari described a growing social movement that he dubs “cultural libertarianism”: the rejection of any and all limitations on absolute free expression.


It’s no coincidence that the “cultural libertarians” Bokhari cites are all leading figures in Gamergate, just as it’s no coincidence that the U.N. report references Zoe Quinn, the first victim of that movement. Well over a year after Quinn’s harassment became international news, we still haven’t answered these fundamental questions about what values the Internet should protect and who is responsible for it.

This U.N. report gets us no closer, alas: all but its most modest proposals are unfeasible. We can educate people about gender violence or teach “digital citizenship” in schools, but persuading social networks to police everything their users post is next to impossible. And even if it weren’t, there are serious implications for innovation and speech: According to the Electronic Frontier Foundation, CDA 230 — the law that exempts online intermediaries from this kind of policing — is basically what allowed modern social networks (and blogs, and comments, and forums, etc.) to come into being.

As reports like this are making increasingly clear, however, these platforms were developed by people who never imagined the struggles that women face online. We’re using tools that weren’t designed for us; they had other people and values and priorities in mind.


Is a reckoning — or at least rebalancing — imminent? The United Nations suggests it has to be. But it certainly won’t look like the model dreamt up in this report. For better or worse, that’s several steps too revolutionary.
Read More >>

Read More

When It Goes Down, Facebook Loses $24,420 Per Minute

At 6:52 p.m. Eastern, Facebook went down. (It began working again at 7:27 p.m.) This is the third such outage in the last several months, and it happens to coincide with the company’s announcement of impressive summer earnings.

The close proximity of outage and earnings makes some uncomfortable math possible.

In the third quarter, Facebook posted revenue of $3.2 billion. The third quarter lasts 91 days, from July 1 to September 30. This amounts to:

$35,164,835 per day
$1,465,201 per hour
$24,420 per minute

If we consider “revenue per minute” as a benchmark for potential losses, Facebook took a bit of a hit this evening. Their last outage, back in August, lasted for 19 minutes and lost them $426,607 (based on second-quarter revenue.) Using the same hypothetical math, this outage cost them a bit more—their third quarter was much more profitable, after all. Though it was down for just 35 minutes, Facebook lost $854,700 in revenue.

Of course, their third-quarter revenue included that August outage, so our loose math may not even be loose enough. And Facebook doesn’t actually have to fork over any cash to advertisers when they experience an outage—they just stop making it.


Regardless, it certainly seems like Facebook can take the hit.

Read More >>

Read More

Facebook will help the UN bring internet access to refugee camps

Refugees already have a hard life, but that's made worse by the typical lack of internet access at refugee camps -- unless you resettle, you may never get online. Facebook isn't content with this state of affairs, however, and is promising to help the United Nations bring internet access to those camps. Company chief Mark Zuckerberg (who revealed the plans at a luncheon) didn't explain how and where this would take place, but it won't be shocking if Facebook relies on its upcoming internet drones to connect these sometimes remote places.

As with efforts from Google and Microsoft, this gesture isn't strictly about kindness. Facebook knows that more internet access means more potential users. As Mark Zuckerberg explains, though, this is an instance where everyone could benefit. Facebook gets more ad views, while refugees can communicate with the rest of the world and (hopefully) get closer to finding permanent homes.


Good news, Engadget peoples! We’re creating a single login system for both our product database and comments. The first part of that transition is a new commenting system, launching on September 29th. You’ll get to keep your current user name (as long as it doesn’t contain invalid characters, in which case you’ll have to go through a few extra steps to make the transfer), and all your old comments will eventually (not immediately) migrate with you.

Read More >>

Read More