DEI — the identity-obsessed dogma that goes by “diversity, equity, and inclusion” — has now trained Google’s new AI to refuse to draw white people. What’s even more alarming is that it’s also infected the supply chain that makes the chips powering everything from AI to missiles, endangering national security.
The Biden administration recently promised it will finally loosen the purse strings on $39 billion of CHIPS Act grants to encourage semiconductor fabrication in the U.S. But less than a week later, Intel announced that it’s putting the brakes on its Columbus factory. The Taiwan Semiconductor Manufacturing Company (TSMC) has pushed back production at its second Arizona foundry. The remaining major chipmaker, Samsung, just delayed its first Texas fab.
This is not the way companies typically respond to multi-billion-dollar subsidies. So what explains chipmakers’ apparent ingratitude? In large part, frustration with DEI requirements embedded in the CHIPS Act.
Commentators have noted that CHIPS and Science Act money has been sluggish. What they haven’t noticed is that it’s because the CHIPS Act is so loaded with DEI pork that it can’t move.
The law contains 19 sections aimed at helping minority groups, including one creating a Chief Diversity Officer at the National Science Foundation, and several prioritizing scientific cooperation with what it calls “minority-serving institutions.” A section called “Opportunity and Inclusion” instructs the Department of Commerce to work with minority-owned businesses and make sure chipmakers “increase the participation of economically disadvantaged individuals in the semiconductor workforce.”
The department interprets that as license to diversify. Its factsheet asserts that diversity is “critical to strengthening the U.S. semiconductor ecosystem,” adding, “Critically, this must include significant investments to create opportunities for Americans from historically underserved communities.”
The department does not call speed critical, even though the impetus for the CHIPS Act is that 90 percent of the world’s advanced microchips are made in Taiwan, which China is preparing to annex by 2027, maybe even 2025.
Handouts abound. There’s plenty for the left—requirements that chipmakers submit detailed plans to educate, employ, and train lots of women and people of color, as well as “justice-involved individuals,” more commonly known as ex-cons. There’s plenty for the right—veterans and members of rural communities find their way into the typical DEI definition of minorities. There’s even plenty for the planet: Arizona Democrats just bragged they’ve won $15 million in CHIPS funding for an ASU project fighting climate change.
That project is going better for Arizona than the actual chips part of the CHIPS Act. Because equity is so critical, the makers of humanity’s most complex technology must rely on local labor and apprentices from all those underrepresented groups, as TSMC discovered to its dismay.
Tired of delays at its first fab, the company flew in 500 employees from Taiwan. This angered local workers, since the implication was that they weren’t skilled enough. With CHIPS grants at risk, TSMC caved in December, agreeing to rely on those workers and invest more in training them. A month later, it postponed its second Arizona fab.
Now TSMC has revealed plans to build a second fab in Japan. Its first, which broke ground in 2021, is about to begin production. TSMC has learned that when the Japanese promise money, they actually give it, and they allow it to use competent workers. TSMC is also sampling Germany’s chip subsidies, as is Intel.
Intel is also building fabs in Poland and Israel, which means it would rather risk Russian aggression and Hamas rockets over dealing with America’s DEI regime. Samsung is pivoting toward making its South Korean homeland the semiconductor superpower after Taiwan falls.
To be fair, Intel has had fabs in Israel since since 1996, and Tower Semiconductor has had fabs in Israel since the 1980s. Poland, to the best of my knowledge, has never had a fab.
In short, the world’s best chipmakers are tired of being pawns in the CHIPS Act’s political games. They’ve quietly given up on America. Intel must know the coming grants are election-year stunts — mere statements of intent that will not be followed up. Even after due diligence and final agreements, the funds will only be released in dribs and drabs as recipients prove they’re jumping through the appropriate hoops.
So in the name of embedding the racist poison of social justice, the CHIPS Act, ostensibly designed to increase America’s share of cutting-edge semiconductor manufacturing, is actually driving new fab construction out of America.
This is a big, big story that doesn’t seem to be getting the sort of attention that a big story should.
An Israeli airstrike that demolished Iran’s consulate in Syria on Monday killed two Iranian generals and five officers, according to Iranian officials. The strike appeared to signify an escalation of Israel’s targeting of military officials from Iran, which supports militant groups fighting Israel in Gaza, and along its border with Lebanon.
Some clarification: Given the location…
…what Israel hit was not a consulate, but Iran’s embassy in Syria. An embassy enjoys certain privliges in international law, though generally those protections apply to the host country (in this case Syria) than a hostile third party (Israel). So let’s just throw this out there:
Since the war in Gaza began nearly six months ago, clashes have increased between Israel and Iran-backed Hezbollah militants based in Lebanon. Hamas, which rules Gaza and attacked Israel on Oct. 7, is also backed by Iran.
Israel, which rarely acknowledges strikes against Iranian targets, said it had no comment on the latest attack in Syria, although a military spokesman blamed Iran for a drone attack early Monday against a naval base in southern Israel.
Israel has grown increasingly impatient with the daily exchanges of fire with Hezbollah, which have escalated in recent days, and warned of the possibility of a full-fledged war. Iranian-backed Houthi rebels in Yemen have also been launching long-range missiles toward Israel, including on Monday.
The airstrike in Syria killed Gen. Mohammad Reza Zahedi, who led the elite Quds Force in Lebanon and Syria until 2016, according to Iran’s Revolutionary Guard. It also killed Zahedi’s deputy, Gen Mohammad Hadi Hajriahimi, and five other officers.
A member of Hezbollah, Hussein Youssef, also was killed in the attack, an official with the militant group told The Associated Press. The official spoke on condition of anonymity in line with group’s rules. Hezbollah has not publicly announced the death.
By the rules of international law, hitting Iran’s embassy is the same as hitting a target in Iran’s own soil. Now, Iran has been funding and supporting terrorist attacks on Israel for decades, funding both Hamas and Hezbollah as part of a proxy war against Israel, and Israel has hit targets inside Iran before, albeit with covert actors rather than airstrikes. Even so, this would seem to be a significant escalation in the proxy war between Iran and Israel.
I don’t any of this amounts to anything close to a war crime. But it may amount to a mistake.
But, weirdly, the world at large doesn’t seem to be treating it as such. There are stories about it, but The All Powerful Algorithm doesn’t seem to be pushing them to the front page. You would think the Iran-loving Obama retread’s guiding Biden’s foreign policy establishment would have encouraged more outraged bleating, but if they have it seems pretty muted.
Likewise, there are no stories about it from conservative media in my inbox.
Even the dark “Biden is going to abandon Israel and side with Iran” muttering types don’t seem to have made much of it.
This is a dog that isn’t barking, and I don’t know why.
If you know what to make of it, feel free to note in the comments below.
A newly discovered backdoor found in the xz liblzma library of XZ Utils, the XZ format compression utilities included in most Linux distributions, targets the RSA implementation of OpenSSH.
For those outside of tech, that sentence was an unreadable jumble of acronyms. For those inside tech, a chill probably ran down their spine, as those technologies are everywhere. Anytime anyone buys something online, they’re going to be using SSH to create a secure channel to pass transaction information. [As a commenter noted, SSH is a command tool rather than Secure Socket Layer (SSL), which is used for encrypted transactions. Mental typo. My bad. – LP.] Depending on how many distros are using that library, the consequence range from “bad” to “really, really bad.”
A vulnerability (CVE-2024-3094) in XZ Utils, the XZ format compression utilities included in most Linux distributions, may “enable a malicious actor to break sshd authentication and gain unauthorized access to the entire system remotely,” Red Hat warns.
The cause of the vulnerability is actually malicious code present in versions 5.6.0 (released in late February) and 5.6.1 (released on March 9) of the xz libraries, which was accidentally found by Andres Freund, a PostgreSQL developer and software engineer at Microsoft.
“After observing a few odd symptoms around liblzma (part of the xz package) on Debian sid installations over the last weeks (logins with ssh taking a lot of CPU, valgrind errors) I figured out the answer: The upstream xz repository and the xz tarballs have been backdoored,” he shared via the oss-security mailing list.
According to Red Hat, the malicious injection in the vulnerable versions of the libraries is obfuscated and only included in full in the download package.
“The Git distribution lacks the M4 macro that triggers the build of the malicious code. The second-stage artifacts are present in the Git repository for the injection during the build time, in case the malicious M4 macro is present,” they added.
“The resulting malicious build interferes with authentication in sshd via systemd.”
I’m just going to note for the record that a whole lot of longtime Linux programmers absolutely hated the introduction of systemd. I don’t have deep enough Linux chops to take a side in this controversy, or know whether systemd was a significant factor in allowing the exploit to work.
Moving on:
The malicious script in the tarballs is obfuscated, as are the files containing the bulk of the exploit, so this is likely no accident.
“Given the activity over several weeks, the committer is either directly involved or there was some quite severe compromise of their system. Unfortunately the latter looks like the less likely explanation, given they communicated on various lists about the “fixes” [for errors caused by the injected code in v5.6.0],” Freund commented.
One silver lining is that the problem doesn’t look to be as widespread as it could be.
“Luckily xz 5.6.0 and 5.6.1 have not yet widely been integrated by Linux distributions, and where they have, mostly in pre-release versions.”
Red Hat says that the vulnerable packages are present in Fedora 41 and Fedora Rawhide, and have urged users of those distros to immediately stop using them.
“If you are using an affected distribution in a business setting, we encourage you to contact your information security team for next steps,” they said, and added that no versions of Red Hat Enterprise Linux (RHEL) are affected.
Since Red Hat is usually the default for big E-commerce platforms, it looks like this exploit is merely “bad” rather than “really, really bad,” which means its not nearly as bad as, say, Log4J was. Your Amazons and eBays are probably safe from the exploit.
The people who are likely going to be hurt by this exploit are mom and pop E-commerce sites using their webhost’s “build an E-commerce site using these easy tools” feature. The smaller the site, the more likely they’re using a free distro, some of which may have this vulnerability.
Whatever the site, they should run an updated software composition analysis tool on stacks and build-chains to see if they’re vulnerable.
You might think that on Christianity’s most holy day, a president running for reelection in a majority Christian nation would go out of his way to avoid antagonizing Christians.
The White House on Friday announced “transgender day of visibility” for March 31, which this year falls on Easter Sunday.
“NOW, THEREFORE, I, JOSEPH R. BIDEN JR., President of the United States of America, by virtue of the authority vested in me by the Constitution and the laws of the United States, do hereby proclaim March 31, 2024, as Transgender Day of Visibility,” President Biden wrote in a Friday statement. “I call upon all Americans to join us in lifting up the lives and voices of transgender people throughout our Nation and to work toward eliminating violence and discrimination based on gender identity.”
Since its inception, the Biden administration has made LGBT activism a cornerstone of its policy priorities. Biden boasted in his statement that he appointed transgender leaders to his administration and ended the ban on transgender Americans serving openly in the military.
In the past, some of Biden’s transgender inclusivity events at the White House have backfired.
A transgender influencer was banned from the White House on Tuesday for posing topless at President Biden’s Pride celebration over the weekend.
Rose Montoya, who exposed his bare prosthetic breasts to the camera and onlookers at the official event, violated basic standards of decency and social manners, a spokesperson for the White House told the New York Post.
Children of the National Guard are also barred from sending in religious Easter egg designs for the 2024 “Celebrating National Guard Families” art event at the White House, Fox News reported Friday. The White House hosts many Easter traditions, including the military family art initiative and the annual Easter Egg Roll.
Easter egg submissions “must not include any questionable content, religious symbols, overtly religious themes, or partisan political statements,” according to the flyer.
You wouldn’t want Christian symbolism in an Easter celebration, now would you?
I’m surprised the Gay Mafia isn’t already suing Masterpiece Cakeshop to make them a cake depicting a crucified Easter Bunny.
Transexist dogma demands that you agree that 2+2=5. To note the biological reality that human beings with XX chromosomes are female, and XY chromosomes are male, and that no amount of cosmetic surgery can ever change that, is commit a heresy against the new church of social justice.
Transesxist dogma is so unpopular that they’re even rejecting it in New York City, but the Biden Administration still insists on forcing it down America’s throats.
Even in an election year.
Even on Easter Sunday.
The brazenness of dedicating Easter Sunday to transexual activism should convince you that the hard left is actively hostile to Christianity. They view it as a competing source of moral legitimacy that thwarts their will-to-power desire of a complete transformation of American society.
More specifically, they want to use social pressure and government coercion to remake Christianity itself in their own image, to make it compliant and subservient to a state they control, just as in Communist China.
People who dedicate their lives to the Risen Christ rather than utopian schemes to remake society are a threat to the left’s plans for total top-to-bottom social control, just like vast numbers of armed citizens are.
The radical left-wing anti-farm green agenda isn’t just trying to destroy agriculture in foreign locales like The Netherlands, it’s also happening in Oregon.
“The state of Oregon has effectively shut down small farms and market gardens on a large scale, and they’re actually sending out cease and desist letters to farms.” (By “market gardens” he means small farms that only supply produce locally.)
“They’re using satellite technology to find their victims and then send them these letters, and say you can’t operate, and they’re doing it in the name of water conservation.”
“Oregon’s government and dairy industry [have joined] forces against small farmers.”
“There are two different laws that they’re using.”
“They’ve redefined what a CAFO is.” CAFO stands for “Concentrated Animal Feeding Operation.” According to Wikipedia, the source of all vaguely accurate knowledge, a CAFO is where “over 1,000 animal units are confined for over 45 days a year. An animal unit is the equivalent of 1,000 pounds of “live” animal weight.[1] A thousand animal units equates to 700 dairy cows, 1,000 meat cows, 2,500 pigs weighing more than 55 pounds (25 kg), 10,000 pigs weighing under 55 pounds, 10,000 sheep, 55,000 turkeys, 125,000 chickens, or 82,000 egg laying hens or pullets.”
Oregon seems to have redefined that. “This applies to people who have chicken houses, who have goat farms, basically anybody who has a barn or a facility that has a gravel or concrete floor.”
“What’s happening in Oregon, and why the small dairies have filed a lawsuit against the state…it doesn’t matter the size of the operation, you could have two milking cows.”
“Sarah King, who owns Godspeed Hollow Farm in Newberg, Oregon, has a pickup station that’s just 100 ft in length. She has an 11 acre property, and keeps things pretty simple. She has three milking cows. [Because] she has that milking stand, the state of Oregon said you are a CAFO, and because you are considered a CAFO, they require you to put in this infrastructure improvement which would cost her $100,000,”
“We’re requiring this massive infrastructure upgrade for you to continue to operate your facilities to protect our ground water from your two cows standing on a milking stand.”
Even if you have a gravel floor in a chicken coop, Oregon wants to come after you. “They have redefined CAFOs. This is going to impact nearly everybody.”
“This law is being enforced in the state of Oregon. It has already shut down some farms.”
There is an injunction on the definition of the law until it can be heard in court.
“You would think that they were going after raw milk, that always seems to be the case with a lot of these things, but this is actually going after anybody. Egg producers, anybody who has chickens that go up in a chicken house at night that may have a concrete floor.”
You have to go through a permitting process, and a lot of what they’re requiring is just simply too much for the small farmer. So that’s rule number one.”
“The second rule: In the state of Oregon, if you are using water, even groundwater, the only water that you can legally harvest and use without a permit is actually rainwater. They consider all water in the ground a resource of the public. Even if you have a private well on your property, that belongs to the people of Oregon.”
“This is a rule that went into place back in 2021, and then it has slowly rolled out to the point where market gardeners with a half acre of land are now receiving cease and desist orders saying you can’t water your gardens. Figure out another way to do it.”
The law says you can use up to 5,000 gallons a day, but market gardeners are proably only using 1,000 gallons a day. “You would think that they’re saying you’re a commercial business, because if you are growing food for yourself [But] There’s a lady has been growing food and selling it to neighbors. It’s been her primary income source and they shut her down.”
“Christina Del Campo um has just over a half acre. She grows blueberries, local vegetables, things like that. Her farm is called Oak Song Farm near Eugene. She’s operated there for 7 years and she recently received received a letter from the regional office of the Oregon Water Resources Department. It was a notification that the farm couldn’t irrigate its commercial crops without a water right.”
“They shut her down because, according to the Oregon Water Resources Department, the exemption for commercial use does not include irrigation of land.”
“Basically, the state of Oregon is coming in now and they’re they’re putting things on people’s wells to measure the amount of water. It’s very invasive.”
“Supposedly Oregon had these rules in place since 1909. They just keep changing them.”
“They’ve sent out letters not just to this one farmer, but multiple small farms, market garden farms, saying you can’t water your crops anymore.”
“This is actually a war on small farms.”
“We’ve seen this happening over and over and over again, where we’re seeing them utilize water rights [protection] to shut down farms across our country.”
“If you look at the number of farms that we’ve lost since 2000, it’s staggering. We’ve gone from 2,100,000 farms in 2000 down to 1,850,000 farms at the end of last year.”
“You’ve seen a lot of these cases where they’ve gone in and they’ve just shut off farms to water rights to an entire valley at a time.”
“We’re seeing them take control over people’s wells putting meters on people’s wells, shutting down small farms.”
“Everybody should have the right to farm fresh food. Oregon is basically taking that right away from every Oregon citizen by taking away the rights of the small farmers to operate their businesses in the name of some laws that were originally put in place to protect groundwater from much larger scale operations.”
If there isn’t some sort of sinister agenda behind these new regulatory pushes, destroying small farms certainly gives a pretty good impression of a sinister agenda. And no points for guessing which political party enjoys uncontested control of Oregon. Remember when Democrats claimed to be looking out for family farms? Doesn’t seem to be the case any more. Someone should ask Willie Nelson about all this…
Texas has a Right to Farm statute that should (theoretically) prevent such abuses here.
Lies trying to hide how bad the Biden Recession sucks continue to unravel, a mini Texas-vs.-California update, Ukraine makes another oil refinery go boom, true depths of human depravity, some Bill Burr and Critical Drinker links, and two tons of Murica. It’s the Friday LinkSwarm!
Against expectations of a small improvement from -11.3 to -10.0, the headline sentiment gauge dropped to -14.4 (the lowest end of analysts’ forecasts).
Furthermore, the production index, a key measure of state manufacturing conditions, fell five points to -4.1, a reading that suggests a slight decline in output month over month.
Other measures of manufacturing activity also indicated declines this month.
The new orders index – a key measure of demand – dropped 17 points to -11.8 after briefly turning positive last month.
The capacity utilization index edged down five points to -5.7, and the shipments index plunged from 0.1 to -15.4.
The decline in new orders came alongside a surge in prices as raw materials costs rose to 13-month highs…
That has the stench of stagflation lathered all over it.
Also worse than reported: employment numbers. “Philadelphia Fed Admits US Payrolls Overstated By At Least 800,000.”
We first have to go back to December 2022, when we reported something shocking: as part of its data analysis of the “more comprehensive, accurate job estimates released by the BLS as part of its Quarterly Census of Employment and Wages (QCEW) program”, the Philadelphia Fed found that the BLS had overstated jobs to the tune of 1.1 million! This is what the Philadelphia Fed wrote in its quarterly Early Benchmark Revision of State Payroll Employment report at the time:
Our estimates incorporate more comprehensive, accurate job estimates released by the BLS as part of its Quarterly Census of Employment and Wages (QCEW) program to augment the sample data from the BLS’s CES that are issued monthly on a timely basis. All percentage change calculations are expressed as annualized rates. Read more about our methodology. Learn more about interpreting our early benchmark estimates.
So what did this “more accurate”, “more comprehensive” report find? It found that…
In the aggregate, 10,500 net new jobs were added during the period rather than the 1,121,500 jobs estimated by the sum of the states; the U.S. CES estimated net growth of 1,047,000 jobs for the period.
Lots of detailed analysis snipped.
Putting it all together, we now know – as the Philly Fed reported first – that the labor market is far weaker than conventionally believed. In fact, no less than 800,000 payrolls are “missing” when one uses the far more accurate Quarterly Census of Employment and Wages data rather than the BLS’ woefully inaccurate and politically mandated payrolls “data”, and if one looks back the the monthly gains across most of 2023, one gets not 230K jobs added on average every month but rather 130K.
Of course, none of that paints Bidenomics in a flattering picture, because while one can at least pretend that issuing $1 trillion in debt every 100 days to add 3 million jos per year is somewhat acceptable, learning that that ridiculous amount buys 800,000 jobs less is hardly the endorsement that the White House needs.
I think I link a story like this every year: “California Leads Among U.S. States Sending People to Texas in 2022. Florida and New York combined sent fewer people to Texas than California.” Leave any leftwing politics behind when you move…
California has a $55 billion deficit. But don’t worry, for the 24-25 fiscal year, it’s a $73 billion deficit.
A Russian-backed “propaganda” network has been broken up for spreading anti-Ukraine stories and paying unnamed European politicians, according to authorities in several countries.
Investigators claimed it used the popular Voice of Europe website as a vehicle to pay politicians.
The Czech Republic and Poland said the network aimed to influence European politics.
Voice of Europe did not respond to the BBC’s request for comment.
Czech media, citing intelligence sources, reported that politicians from Germany, France, Poland, Belgium, the Netherlands and Hungary were paid by Voice of Europe in order to influence upcoming elections for the European Parliament.
The German newspaper Der Spiegel said the money was either handed over in cash in covert meetings in Prague or through cryptocurrency exchanges.
Pro-Russian Ukrainian oligarch Viktor Medvedchuk is alleged by the Czech Republic to be behind the network.
Mr Medvedchuk was arrested in Ukraine soon after the Russian invasion, but later transferred to Russia with about 50 prisoners of war in exchange for 215 Ukrainians.
Czech authorities also named Artyom Marchevsky, alleging he managed the day-to-day business of the website. Both men were sanctioned by Czech authorities.
“$100M missing from Bay area trust fund management company. A Bay area father who counted on a local non-profit to handle a trust fund designed for his daughter’s long-term care feels duped.” And this is a trust for special needs kids.
The radical leftists in control of Baltimore City Hall have plunged the metro area just north of Washington, DC, into apocalyptic levels. We advise readers to entirely avoid the metro area as violent crime spirals out of control.
Failed social justice reforms, defunding the police, and widespread mistrust of the police have resulted in a skeleton police force that will no longer be able to protect residents in some regions of the city.
Fox Baltimore reported last Tuesday that only three police officers were on duty for the Southern Police District, which includes more than 61,000 residents.
Joe Lieberman, RIP. One of the least reprehensible Democratic senators of the last 30 years or so. But I still remember this:
Don’t click on this link unless you want to plumb the depths of human depravity. Noteworthy: “He and his husband.”
Stellantis, AKA The European Monster That Ate Chrysler, just just laid off a whole bunch of white collar workers. Note their mention of focusing on “implementing our EV product offensive.” Oh yeah, they’re boned.
Florida Governor Ron DeSantis declares victory over Disney, as the latter has dropped their lawsuit over the the elimination of their special district status.
Sean Combs, AKA “Puff Daddy,” AKA “Diddy,” raided by the FBI. “A source close to the investigation told NBC News that the raid was connected to allegations of sex-trafficking and sexual assault and the solicitation and distribution of illegal narcotics and firearms.” “Source close” caveats apply.
The federal government is going to allow a shuttered nuclear power plant to be restarted. “The federal government announced that it would provide a $1.5 billion loan to restart a nuclear power plant in southwestern Michigan. NJ-based Holtec International acquired the 800-megawatt Palisades plant in 2022 with plans to dismantle it, but with support from the state of Michigan and the Biden administration, the emphasis has shifted to restarting the nuclear power plant by late 2025 instead.” Not wild about the loan part, but restarting America’s nuclear energy growth is long overdue.
Used Japanese homes are worthless Not just because of the shrinking population, but because they’re designed to be.
The Critical Drinker is not impressed with the Road House remake. “The Patrick Swayze original wasn’t exactly peak cinema. It was dumb and over-the-top and silly, and I don’t imagine people were exactly crying out for a remake. But damn, man, it’s like Citizen Kane compared to this version.”
School tries to ban American flag from truck. Result: Two tons of Murica.
Twitch is cracking down on streams that “focus on intimate body parts.” After watching this, I have one question: Where exactly did the lady featured obtain her “automatic butt jiggler?”
Feel-good crime aftermath story:
Dog shot during the robbery given a warm send off by hospital staff after undergoing multiple surgeries..🐕🐾🥺🙏❤️ pic.twitter.com/OnSjqmRt2u
At the request of CEO Mark Zuckerberg, Facebook officials developed a program called In-App Action Panel (IAAP) that they deployed in 2016 and which was in use through mid-2019, according to the documents, which include internal emails.
The program utilized cyberattacks to intercept information from Snapchat, YouTube, and Amazon. The program then decrypted the information.
“Facebook’s IAAP Program used nation-state-level hacking technology developed by the company’s Onavo team, in which Facebook paid contractors (including teens) to designate Facebook a trusted ‘root’ certificate authority on their mobile devices, then generated fake digital certificates to redirect secure Snapchat analytics traffic (and later, analytics from YouTube and Amazon) from Snapchat’s servers to Onavo’s; decrypted these analytics and used them for competitive gain, including to inform Facebook’s product strategy; reencrypted them; and sent them up to Snapchat’s servers as though it came straight from Snapchat’s app, with Facebook’s Social Advertising competitor none the wiser,” lawyers said in one of the documents.
This is a clever attack in several ways. If you can create and get a program/device to accept a false signing certificate, you bypass having to break a company’s encryption altogether. The program trusts your fake certificate and creates a secure connection to your backend, using your encryption, thinking it’s transmitting information back to the targeted company. Also, analytics data doesn’t have to be sent and received in real time, so a significant delay in gather and receive times may not tip off the targeted company to the attack.
None of this is a walk in the park, but it’s something like ten orders of magnitude easier than breaking the targeted company’s encryption stream on a live session to seamlessly hack it in real time, which is the sort of God-level hacking limited to those with NSA-level computing power, or fictional characters.
The lawyers, representing plaintiffs in a lawsuit that accuses Facebook of anti-competitive behavior, were describing emails they obtained through discovery.
In one email, Mr. Zuckerberg wrote that there was a need to receive information about Snapchat but that their traffic was encrypted. “Given how quickly they’re growing, it seems important to figure out a new way to get reliable analytics about them. Perhaps we need to do panels or write custom software. You should figure out how to do this,” he wrote.
After Facebook employees started working on figuring it out, Facebook Chief Operating Officer Javier Olivan wrote that the program could pay users to “let us install a really heavy piece of software (that could even do man in the middle, etc.).”
Man in the middle refers to a type of cyberattack where attackers secretly intercept information.
More specifically, it’s where a third party successfully inserts itself into the communication stream between two other parties, relaying (and possibly altering) both ends of the communication without either party knowing.
“We are going to figure out a plan for a lockdown effort during June to bring a step change to our Snapchat visibility. This is an opportunity for our team to shine,” Guy Rosen, founder of Onavo, later wrote. Onavo was started in Israel and bought by Facebook in 2013.
In a presentation on the program when it was being finalized, it was stated that there would be “’kits” that can be installed on iOS and Android that intercept traffic for specific sub-domains, allowing us to read what would otherwise be encrypted traffic so we can measure in-app usage.”
Documents and testimony obtained in the case showed the program was launched in June 2016 and continued being used through 2019.
The program initially targeted Snapchat but was later expanded to Google’s YouTube and Amazon, according to the documents.
A few quick points:
This is all from Snapchat’s court documents, so you have to put an “allegedly” on all this.
That Zuckerberg himself is (allegedly) directly implicated in deliberately breaking federal law is pretty breathtaking. He could be looking at serious jail time. Or would be, if he weren’t such a big Democratic Party Donor. (We’ll see how much time Sam Bankman-Fried catches today.)
Snapchat is one thing, but targeting fellow tech behemoths Google (which owns YouTube) and Amazon with this sort of attack would seem to be…unwise. (Maybe Google’s forgiveness was covered in the secret deal the two companies allegedly signed with each other.)
The timeframe is important here. Back in 2016-2019, the handling of digital signing certificates was a lot more loosey-goosey than it is now. A whole lot of things have been tightened up. I wouldn’t say it’s impossible to carry out such an attack now, but it would be harder.
We’ll see if the whole thing jumps from litigation land to the feds actually going after Facebook, but at a time when Facebook is being sued by all manner of plaintiffs (including Texas and other state attorney generals) over privacy violations and anti-competitive practices, the Snapchat revelations could certainly provide more fuel for the fire…
“If you watch certain YouTube videos, investigators demanded your data from Google.”
“Investigators have approached Google and said ‘We want to know who watched certain videos, give that information up.’ So as Chase [DiBenedetto] writes, if you’ve ever jokingly wondered if your search or viewing history is going to put you on some kind of watch list, your concern may be more than warranted.”
“Google was ordered to hand over the names, addresses, telephone numbers and user activity of YouTube accounts and IP addresses that watched certain YouTube videos, which was part of a larger criminal investigation by federal investigators.”
It turns out the feds had sent a link to this video to a single “suspected cryptocurrency launderer,” but was able to get a warrant for personal details on everyone who watched it.
Also, it wasn’t some sort of illegal video, either. They were “public YouTube tutorials on mapping via drones and augmented reality software. Forbes says the videos were watched more than 30,000 times, presumably by thousands of users unrelated the case.” But the government now has their personal data. And the past five years has shown that if the deep state gets your data, they won’t hesitate to abuse it to advance their interests.
Google says they “push back” against overbroad demands. But given how woke Google has become, how hard do you think they’re going to push aback against data demands targeting the right?
“This is the latest chapter in a disturbing trend where we see government agencies increasingly transforming search warrants into digital dragnets.”
“It’s unconstitutional, it’s terrifying, and it’s happening every day.”
“When you’re on the internet, your actions are being tracked by all kinds of entities.”
“The scary part is they’ve got this information on you to begin with, but we’ve known that for a while.”
“Your car is snitching on you, and so on so is your smartphone, and now so is Google, on occasion.”
“‘We want the information on tens of thousands of people,’ and suddenly you realize ‘OK, this is an extremely broad search. Couldn’t you narrow it a little better than that?'”
Asking for such information in a search warrant is an overly-broad abuse of power and violation of privacy rights, and also suggests sloppy investigative technique on the part of the feds.
Here’s hoping the courts quash such requests in he future.
After nine long years, seven years after the corresponding federal charges were thrown out, the case against Texas Attorney general Ken Paxton has ended with a whimper.
A trial set to begin in Harris County District Court on April 15 has been canceled after Texas Attorney General Ken Paxton obtained a pretrial agreement with special prosecutors to drop nine-year-old felony securities charges against him in exchange for meeting several conditions.
Paxton was indicted in 2015 on three felony counts relating to state securities fraud – with the allegation that he did not disclose a financial ownership interest in a company that he solicited others to invest in, in addition to not being a registered investment advisor when doing so.
A plethora of legal issues have resulted in the case lingering for years before finally being set for trial, including battles over the payment of the special prosecutors handling the charges and motions regarding what judicial venue should ultimately host the case.
But after the Court of Criminal Appeals cleared the way last year for the venue to be set in Harris County, the trial date was finally set and all sides appeared ready to move forward.
That was until Tuesday, when after a meeting at the Harris County Courthouse attorneys for Paxton, along with the special prosecutors handling the case, announced a pretrial diversion agreement had been reached, in which the charges would be dropped once Paxton meets several terms.
Under the deal, Paxton must undergo 100 hours of community service in Collin County, take 15 hours of continuing legal education in ethics, and pay restitution of up to $300,000.
$300,000 is a considerable chunk of change, but I doubt it’s going to cramp the style of someone who practiced corporate law for a quarter of a century before being elected Attorney General.
But serving 100 hours of community service for three accused felonies is like getting a murder charge pled down to a traffic ticket. I sincerely doubt the plea will tarnish Paxton’s reputation among the voting public.
This was the best shot Democrats had to end Paxton’s career and it didn’t amount to a hill of beans. He shows every sign of being around for Democrats to hate for a long, long time.
Indeed, this is the first interest rate hike for Japan in 17 years.
According to Keynesian economics, Japan should have experienced an economic boom from all that monetary stimulus. It did not. Prices were stagnant. Wages were stagnant. GDP growth was anemic.
Yet deficit spending remains the preferred policy solution of just about every damn country in the world.
Back in the dim mists of time (i.e., the 1980s), Japan Inc. was going to take over the world. That didn’t happen either. Instead, the Japanese bubble, based in huge measure on wildly unsustainable real estate valuations (“At the peak of the bubble economy, Tokyo real estate could sell for as much as US$139,000 per square foot, which was nearly 350 times as much as equivalent space in Manhattan. By that reckoning, the Imperial Palace in Tokyo was worth as much as the entire US state of California.”) popped. There then followed three decades of economic stagnation.
