Enlarge (credit: PM Images | DigitalVision)

On Wednesday, Colorado expanded the scope of its privacy law initially designed to protect biometric data like fingerprints or face images to become first in the nation to also shield sensitive neural data.

That could stop companies from hoarding brain activity data without residents realizing the risks. The New York Times reported that neural data is increasingly being collected and sold nationwide. And after a market analysis showed that investments in neurotechnology leapt by 60 percent globally from 2019 to 2020—and were valued at $30 billion in 2021—Big Tech companies have significantly intensified plans to develop their own products to rake in potentially billions.

For instance, in 2023, Meta demoed a wristband with a neural interface used to control its smart glasses and unveiled an AI system that could be used to decode the mind. In January, Elon Musk announced that Neuralink implanted its first brain chip in a human that can be used to control a device with their thoughts. And just last month, Apple Insider reported that "Apple is working on technology that could turn the Apple Vision Pro into a brainwave reader to improve mental health, assist with training and workouts, and help with mindfulness."

Enlarge (credit: Getty Images)

It's easy to get the impression that Discord chat messages are ephemeral, especially across different public servers, where lines fly upward at a near-unreadable pace. But someone claims to be catching and compiling that data and is offering packages that can track more than 600 million users across more than 14,000 servers.

Joseph Cox at 404 Media confirmed that Spy Pet, a service that sells access to a database of purportedly 3 billion Discord messages, offers data "credits" to customers who pay in bitcoin, ethereum, or other cryptocurrency. Searching individual users will reveal the servers that Spy Pet can track them across, a raw and exportable table of their messages, and connected accounts, such as GitHub. Ominously, Spy Pet lists more than 86,000 other servers in which it has "no bots," but "we know it exists."

• 

  An example of Spy Pet's service from its website. Shown are a user's nicknames, connected accounts, banner image, server memberships, and messages across those servers tracked by Spy Pet. [credit: Spy Pet ]

As Cox notes, Discord doesn't make messages inside server channels, like blog posts or unlocked social media feeds, easy to publicly access and search. But many Discord users many not expect their messages, server memberships, bans, or other data to be grabbed by a bot, compiled, and sold to anybody wishing to pin them all on a particular user. 404 Media confirmed the service's function with multiple user examples. Private messages are not mentioned by Spy Pet and are presumably still secure.

Enlarge

Electricity supply is becoming the latest chokepoint to threaten the growth of artificial intelligence, according to leading tech industry chiefs, as power-hungry data centers add to the strain on grids around the world.

Billionaire Elon Musk said this month that while the development of AI had been “chip constrained” last year, the latest bottleneck to the cutting-edge technology was “electricity supply.” Those comments followed a warning by Amazon chief Andy Jassy this year that there was “not enough energy right now” to run new generative AI services.

Amazon, Microsoft, and Google parent Alphabet are investing billions of dollars in computing infrastructure as they seek to build out their AI capabilities, including in data centers that typically take several years to plan and construct.

Enlarge (credit: LinkedIn)

An accomplished and prominent transplant surgeon in Texas allegedly falsified patient data in a government transplant waiting list, which may have prevented his own patients from receiving lifesaving liver transplants, according to media reports and hospital statements.

Memorial Hermann-Texas Medical Center halted its liver transplant program on April 3 after finding "irregularities" with donor acceptance criteria, the Houston Chronicle reported based on a statement from the hospital. At the time there were 38 patients on the hospital's wait list for a liver. Earlier this week, the hospital also halted its kidney transplant program, telling the Chronicle that it was pausing operations to "evaluate a new physician leadership structure."

Memorial Hermann has not named the surgeon behind the "inappropriate changes," but The New York Times identified him as Dr. Steve Bynon, a surgeon who has received numerous accolades and, at one point, appears to have been featured on a billboard. Bynon oversaw both the liver and kidney transplant programs at Memorial Hermann.

Enlarge (credit: Anadolu / Contributor | Anadolu)

To settle a class-action dispute over Chrome's "Incognito" mode, Google has agreed to delete billions of data records reflecting users' private browsing activities.

In a statement provided to Ars, users' lawyer, David Boies, described the settlement as "a historic step in requiring honesty and accountability from dominant technology companies." Based on Google's insights, users' lawyers valued the settlement between $4.75 billion and $7.8 billion, the Monday court filing said.

Under the settlement, Google agreed to delete class-action members' private browsing data collected in the past, as well as to "maintain a change to Incognito mode that enables Incognito users to block third-party cookies by default." This, plaintiffs' lawyers noted, "ensures additional privacy for Incognito users going forward, while limiting the amount of data Google collects from them" over the next five years. Plaintiffs' lawyers said that this means that "Google will collect less data from users’ private browsing sessions" and "Google will make less money from the data."

Enlarge (credit: Getty Images | VIEW press )

AT&T reset passcodes for millions of customers after acknowledging a massive leak involving the data of 73 million current and former subscribers.

"Based on our preliminary analysis, the data set appears to be from 2019 or earlier, impacting approximately 7.6 million current AT&T account holders and approximately 65.4 million former account holders," AT&T said in an update posted to its website on Saturday.

An AT&T support article said the carrier is "reaching out to all 7.6 million impacted customers and have reset their passcodes. In addition, we will be communicating with current and former account holders with compromised sensitive personal information." AT&T said the leaked information varied by customer but included full names, email addresses, mailing addresses, phone numbers, Social Security numbers, dates of birth, AT&T account numbers, and passcodes.

Enlarge / An Amazon Web Services (AWS) data center under construction in Stone Ridge, Virginia, in March 2024. Amazon will spend more than $150 billion on data centers in the next 15 years. (credit: Getty Images)

Redis, a tremendously popular tool for storing data in-memory rather than in a database, recently switched its licensing from an open source BSD license to both a Source Available License and a Server Side Public License (SSPL).

The software project and company supporting it were fairly clear in why they did this. Redis CEO Rowan Trollope wrote on March 20 that while Redis and volunteers sponsored the bulk of the project's code development, "the majority of Redis’ commercial sales are channeled through the largest cloud service providers, who commoditize Redis’ investments and its open source community." Clarifying a bit, "cloud service providers hosting Redis offerings will no longer be permitted to use the source code of Redis free of charge."

Clarifying even further: Amazon Web Services (and lesser cloud giants), you cannot continue reselling Redis as a service as part of your $90 billion business without some kind of licensed contribution back.

Enlarge (credit: Lisa5201 | E+)

On Monday, Florida became the first state to ban kids under 14 from social media without parental permission. It appears likely that the law—considered one of the most restrictive in the US—will face significant legal challenges, however, before taking effect on January 1.

Under HB 3, apps like Instagram, Snapchat, or TikTok would need to verify the ages of users, then delete any accounts for users under 14 when parental consent is not granted. Companies that "knowingly or recklessly" fail to block underage users risk fines of up to $10,000 in damages to anyone suing on behalf of child users. They could also be liable for up to $50,000 per violation in civil penalties.

In a statement, Florida governor Ron DeSantis said the "landmark law" gives "parents a greater ability to protect their children" from a variety of social media harm. Florida House Speaker Paul Renner, who spearheaded the law, explained some of that harm, saying that passing HB 3 was critical because "the Internet has become a dark alley for our children where predators target them and dangerous social media leads to higher rates of depression, self-harm, and even suicide."

Enlarge (credit: Mozilla)

Mozilla's Monitor Plus, a service launched by the privacy-minded tech firm in February, notes on its pitch page that there is "a $240 billion industry of data brokers selling your private information for profit" and that its offering can "take back your privacy."

Mozilla's most recent move to protect privacy has been to cut out one of the key providers of Monitor Plus' people-search protections, Onerep. That comes after reporting from security reporter Brian Krebs, who uncovered Onerep CEO and founder Dimitri Shelest as the founder of "dozens of people-search services since 2010," including one, Nuwber, that still sells the very kind of "background reports" that Monitor Plus seeks to curb.

Shelest told Krebs in a statement (PDF) that he did have an ownership stake in Nuwber, but that Nuwber has "zero cross-over or information-sharing with Onerep" and that he no longer operates any other people-search sites. Shelest admitted the bad look but said that his experience with people search gave Onerep "the best tech and team in the space."

Enlarge (credit: Aurich Lawson | Getty Images)

After public outcry, General Motors has decided to stop sharing driving data from its connected cars with data brokers. Last week, news broke that customers enrolled in GM's OnStar Smart Driver app have had their data shared with LexisNexis and Verisk.

Those data brokers in turn shared the information with insurance companies, resulting in some drivers finding it much harder or more expensive to obtain insurance. To make matters much worse, customers allege they never signed up for OnStar Smart Driver in the first place, claiming the choice was made for them by salespeople during the car-buying process.

Now, in what feels like an all-too-rare win for privacy in the 21st century, that data-sharing deal is no more.

Enlarge (credit: Getty Images)

Researchers have unearthed never-before-seen wiper malware tied to the Kremlin and an operation two years ago that took out more than 10,000 satellite modems located mainly in Ukraine on the eve of Russia’s invasion of its neighboring country.

AcidPour, as researchers from security firm Sentinel One have named the new malware, has stark similarities to AcidRain, a wiper discovered in March 2022 that Viasat has confirmed was used in the attack on its modems earlier that month. Wipers are malicious applications designed to destroy stored data or render devices inoperable. Viasat said AcidRain was installed on more than 10,000 Eutelsat KA-SAT modems used by the broadband provider seven days prior to the March 2022 discovery of the wiper. AcidRain was installed on the devices after attackers gained access to the company’s private network.

Sentinel One, which also discovered AcidRain, said at the time that the earlier wiper had enough technical overlaps with malware the US government attributed to the Russian government in 2018 to make it likely that AcidRain and the 2018 malware, known as VPNFilter, were closely linked to the same team of developers. In turn, Sentinel One’s report Thursday noting the similarities between AcidRain and AcidPour provides evidence that AcidPour was also created by developers working on behalf of the Kremlin.

Enlarge (credit: Aurich Lawson | Getty Images)

Few Ars readers will have been surprised by the news from last week concerning General Motors' connected cars. As The New York Times reported, some owners of vehicles made by General Motors have been having a hard time getting car insurance. The reason? They unwittingly agreed to share their driving data with a third party. Now, at least one driver is suing. If more follow suit, this could be the push the industry needs to do better.

The heart of the problem is one of GM's OnStar connected-car services, called Smart Driver. We've tested it out in the past—it monitors things like how fast you drive, how hard you accelerate and brake, how often you drive at night, and your fuel economy, then uses that data to generate a numerical score from 0 to 100, with a higher number indicating that you're a safer driver.

These kinds of services can be useful—most people think they're great drivers until they start getting independent feedback. And the data that Smart Driver collects really can help you drive more economically and with less risk. But as I noted at the time, I was glad my insurance rates weren't at risk via data sharing with an insurer.

Enlarge (credit: DigiPub | Moment)

Glassdoor, where employees go to leave anonymous reviews of employers, has recently begun adding real names to user profiles without users' consent, a Glassdoor user named Monica was shocked to discover last week.

"Time to delete your Glassdoor account and data," Monica, a Midwest-based software professional, warned other Glassdoor users in a blog. (Ars will only refer to Monica by her first name so that she can speak freely about her experience using Glassdoor to review employers.)

Monica joined Glassdoor about 10 years ago, she said, leaving a few reviews for her employers, taking advantage of other employees' reviews when considering new opportunities, and hoping to help others survey their job options. This month, though, she abruptly deleted her account after she contacted Glassdoor support to request help removing information from her account. She never expected that instead of removing information, Glassdoor's support team would take the real name that she provided in her support email and add it to her Glassdoor profile—despite Monica repeatedly and explicitly not consenting to Glassdoor storing her real name.

Enlarge (credit: NurPhoto / Contributor | NurPhoto)

Meta is considering cutting monthly subscription fees for Facebook and Instagram users in the European Union nearly in half to comply with the Digital Market Act (DMA), Reuters reported.

During a day-long public workshop on Meta's DMA compliance, Meta's competition and regulatory director, Tim Lamb, told the European Commission (EC) that individual subscriber fees could be slashed from 9.99 euros to 5.99 euros. Meta is hoping that reducing fees will help to speed up the EC's process for resolving Meta's compliance issues. If Meta's offer is accepted, any additional accounts would then cost 4 euros instead of 6 euros.

Lamb said that these prices are "by far the lowest end of the range that any reasonable person should be paying for services of these quality," calling it a "serious offer."