Search Results for: vice.com

We Are All Swimming in A.I. Murk ⇥ 404media.co

Jason Koebler, 404 Media:

To browse the internet today, to consume any sort of content at all, is to be bombarded with AI of all sorts. People think things that are fake are real, things that are real are fake. Much has been written about “AI psychosis,” the nonspecific, nonscientific diagnosis given to people who have lost themselves to AI. Less has been said about the cognitive load of what other people’s AI use is doing to the rest of us, and the insidious nature of having to navigate an internet and a world where lazy AI has infiltrated everything. Our brains are now performing untold numbers of calculations per day: Is this AI? Do I care if it’s AI? Why does this sound or look or read so weird? Does this person just write like this? Is this a person at all?

I imagine there are some people who do not much care if the news article they are reading or the music they are listening to was generated by A.I. — with or without their knowledge. I think it feels cheap and shameful. There are interesting uses for generating material based on known patterns and structures but we are stuck with a bunch of spam, and it makes everything feel inherently suspicious. Perhaps that is in some way a good thing; we should be more careful, in general. I think Koebler captures the feeling of being on constant high alert, and living in an increasingly artificial and scam-filled world.

A Toolkit for Hacking iPhones, Possibly Created for the U.S. Government, Has Leaked ⇥ cloud.google.com

Google’s Threat Intelligence Group:

Google Threat Intelligence Group (GTIG) has identified a new and powerful exploit kit targeting Apple iPhone models running iOS version 13.0 (released in September 2019) up to version 17.2.1 (released in December 2023). The exploit kit, named “Coruna” by its developers, contained five full iOS exploit chains and a total of 23 exploits. The core technical value of this exploit kit lies in its comprehensive collection of iOS exploits, with the most advanced ones using non-public exploitation techniques and mitigation bypasses.

The Coruna exploit kit provides another example of how sophisticated capabilities proliferate. Over the course of 2025, GTIG tracked its use in highly targeted operations initially conducted by a customer of a surveillance vendor, then observed its deployment in watering hole attacks targeting Ukrainian users by UNC6353, a suspected Russian espionage group. We then retrieved the complete exploit kit when it was later used in broad-scale campaigns by UNC6691, a financially motivated threat actor operating from China. […]

Andy Greenberg, Wired:

Conspicuously absent from Google’s report is any mention of who the original surveillance company “customer” that deployed Coruna may have been. But the mobile security company iVerify, which also analyzed a version of Coruna it obtained from one of the infected Chinese sites, suggests the code may well have started life as a hacking kit built for or purchased by the US government. Google and iVerify both note that Coruna contains multiple components previously used in a hacking operation known as “Triangulation” that was discovered targeting Russian cybersecurity firm Kaspersky in 2023, which the Russian government claimed was the work of the NSA. (The US government didn’t respond to Russia’s claim.)

I am so curious to know how this thing made it outside the carefully guarded digital walls of the U.S. government or a contractor. While a rare event, it is not the first time the classified weapons of espionage have become public.

News Sites Are Bringing Comments Sections Back as a Paid Feature ⇥ open.substack.com

Ben Whitelaw, writing for the New Public:

Publishers saw comment sections as a reputational hazard and a cost centre and, by the middle of the decade, a dozen sites — including Popular Science, Chicago Sun-Times, Motherboard, Reuters, and NPR — had significantly reduced or completely disabled commenting features. Each argued, often without the data to back it up, that its readers preferred to discuss stories via social media. And so, what was once heralded as a new frontier of reader dialogue died a not-so-quiet death.

A decade on, something surprising is happening: reader comments are having a mini renaissance. After years of chasing social media engagement and being burned in the process, publishers have realised that commenting has a tangible value — to the broader public, yes, but also in terms of advertising and subscription revenue.

Via Karl Bode, Techdirt:

The rush to vilify and eliminate the comment section ignored, as Ben notes, that a subscription to news outlets doesn’t just have to provide access to journalism, it can feature participation in journalism. As an online writer for decades, I’ve seen every insult known to man; at the same time I’ve routinely seen comment insight that either taught me something new or helped me correct errors in my reporting that both I and my editors missed.

The obliteration of the comment section threw that baby out with the bath water. Facebook comments are, if you haven’t noticed, a homogenized shit hole full of bots, rage, and bile that undermines connection and any effort at real conversation. These sorts of badly run systems are also more easily gamed by bad actors (like, say, authoritarians using culture war agitprop to confuse the electorate and take power).

I think I remain personally uninterested in having a comments section, but Whitelaw’s article has certainly made me consider how strongly I have that stance. It is tough because, while I expect readers would be respectful of one another — I often appreciate the comments under one of Michael Tsai’s posts — I am still wary of taking on the role of a moderator.

One thing both of these articles reinforced, however, is my pet theory that anonymity was never the problem. Whitelaw, who formerly led moderation of the Times of London’s comment section, writes of a commenter who wrote under their real name and was so “infamously combative” that they were eventually banned. Bode’s reference to the Facebook comments plugin — which goes away next week — is also a reminder that even people using their real identity were hostile commenters. The problem has always been with overly permissive moderation policies.

‘Mood Machine’

The goals of art and commerce are basically opposite. Art fills our soul; it gives us emotional life. I have rarely heard anyone describe commerce similarly.

At its most ideal, the business of art enables more of it in greater variety, while allowing those who create it a reasonable living. This has rarely been the case. There are hundreds of years of unbelievably wealthy patrons building their cultural cachet by supporting artists of their particular taste and at their behest. More recently, recording contracts are routinely described as “brutal”, “a raw deal”, “predatory”, and “exploitative”. That has been generally true for all artists, but has been particularly pronounced for marginalized — and, to be more even specific, black — artists since the recording industry’s origins.

In “Mood Machine”, released earlier this year, Liz Pelly adds an additional complicating question: what is the relationship between art and commerce when massive data collection becomes routine?

The origins of streaming music may be found first in piracy and later in Rhapsody, but Spotify is where modern streaming platforms truly began. While Spotify’s founders tend to describe a noble birth, Perry points to a 2015 interview with co-founder Martin Lorentzon in which he describes the idea to build a targeted advertising platform first. How it would acquire users was an open question — “[s]hould it be product search? Should it be movies, [or ‘Godfather’], or audiobooks? And then we ended up with music”. That is not necessarily a bad thing. What is bad, though, is that Spotify reportedly began with an unlicensed library and made money on the back of it. That combination does not sound to me like the result of a love of music.

Sadly, the interesting storytelling does not reliably continue. Admittedly, part of the reason for this is my personal distaste for Pelly’s style of writing, something which I would not normally mention — surely not everyone is a fan of my writing style, either — but feel compelled to do so for how intrusive I found it. Far too many sections and chapters in this book end in a tedious turn of phrase: “Under the gaze of streaming surveillance, the exchange is never truly one-to-one;”; “It makes sense that as the digital world has grown to feel more like a shopping mall, it is also sometimes the very companies making music for shopping malls that are flooding its soundtrack”. Another part of the problem is the way this book is organized. Each chapter reads like an individual essay dedicated to a specific problem with Spotify — algorithmic suggestions, vibe-based playlists, and changing business terms, to name a few. What that looks like in practice is a great deal of repetition. I count at least seven chapters, of eighteen, dedicated to background and unfocused listening.

Part of the problem, however, is that Pelly has been documenting these phenomena for years in articles published at the Baffler. I am familiar with the extraordinary amount of “chill” music, trendy sound palettes, the relationship between mood-based music and targeted advertising, and the comparisons to Uber because these articles were all published a minimum of six years ago. That I remember these articles is sometimes a testament to Pelly’s reporting; at other times, it reminds me of things I previously found questionable but could not quite articulate why.

One thing I remember from one article, for example, is its attempt to define a “Spotify sound”. This was revisited in the book in the “Streambait Pop” chapter (page 82):

By the time of Spotify’s IPO in 2018, it seemed that the peak playlist era had produced an aesthetic of its own. That year, one pop songwriter and producer told me that [Billie] Eilish had become a type of poster child for what was being called a “Spotify sound,” a deluge of platform-optimized pop that was muted, mid-tempo, and melancholy. He told me it had become normal for him to go into a session and hear someone say they wanted to write a “Spotify song” to pitch around to artists: “I’ve definitely been in circumstances where people are saying, ‘Let’s make one of those sad girl Spotify songs.’ You give yourself a target,” he said. It was a formula. “It has this soft, emo-y, cutesy thing to it. These days it’s often really minimal and based around just a few simple elements in verses. Often a snap in the verses. And then the choruses sometimes employ vocal samples. It’s usually kind of emo in lyrical nature.”

Pelly’s argument is built primarily around the works of Charlotte Lawrence, Sasha Sloan, and Nina Nesbitt, none of which I am familiar with. But their music — “Normal” and “Psychopath” are both named in the article — sound like a lot of pop music trends of the time: a blend of genres that emerges kind of beach-clubby, pretty breathy, and electronics-heavy but not particularly danceable. Pelly quotes an indie rock label owner calling it “emotional wallpaper”.

In re-reading Pelly’s “streambait” article for this piece, I found this paragraph a good distillation of many arguments made throughout the book:

Musical trends produced in the streaming era are inherently connected to attention, whether it’s hard-and-fast attention-grabbing hooks, pop drops and chorus-loops engineered for the pleasure centers of our brains, or music that strategically requires no attention at all—the background music, the emotional wallpaper, the chill-pop-sad-vibe playlist fodder. These sounds and strategies all have streambait tricks embedded within them, whether they aim to wedge bits of a song into our skulls or just angle toward the inoffensive and mood-specific-enough to prevent users from clicking away. All of this caters to an economy of clicks and completions, where the most precious commodity is polarized human attention — either amped up or zoned out—and where success is determined, almost in advance, by data.

Much like the similar essays in “Mood Machine”, very little of this feels like it is directly traceable to Spotify or streaming generally. There has long been pop music that is earwormy, and pop music that is kind of a silence-filler. When radio was more influential, the former could be found on the contemporary hit radio station and the latter on any number of adult contemporary variants.

Coalescing around a particular sound is also not a Spotify phenomenon. The early 1990s brought an onslaught of Nirvana imitators, and the late 1990s polished the sound so hard it removed any trace of edge and intrigue it once held. The early-2000s dominance of Coldplay made way for the mid-2000s Timbaland production craze, which led to a wave of late-2000s dance and club pop, which was followed in the early-2010s by Americana revival. This is the power of radio. Or, it was the power of radio, at least. You could describe any of the chart-topping songs in similar terms as Pelly uses for “streambait”: “attention-grabbing hooks”, “chorus-loops engineered for the pleasure centers of our brains”, and “chill-pop-sad-vibe playlist fodder”. Should this be blamed on the precise listener analytics dashboard available to artists on Spotify? I am not sufficiently convinced.

Pelly describes a discussion she had with two teenagers outside an all-ages venue as they struggled to describe the “aesthetic rap” show they were attending, a genre which seems to be a slower and spacier take on rage (page 118):

The kids I spoke to outside Market seemed genuinely enthused. But as I headed home, I was struck by how palpably it seemed that most of those conversations were more concerned with a niche vibe fandom — which no one could even really explain — than the artists themselves.

I cannot imagine this is a new phenomenon. Some people develop a deep fascination with music and seek releases from specific artists. But plenty are only looking for a sound and a vibe. It is why retailers and magazines gave away sampler CDs in the mid-2000s scratching a generic indie rock itch.

What Pelly keeps describing in these chapters is a kind of commodification of cool, none of which is new or unique to Spotify. It is the story of popular culture writ large: things begin as cool for a small group, are absorbed into broader society, and are sold back to us by industry. This most often happens to marginalized communities who find community in vocabulary, music, visual art, and dance, and then it gets diluted as it becomes mainstreamed.

As noted, Pelly dedicates considerable space in the book to chill playlists — “‘Chilled Dance Hits,’ ‘Chilled R&B,’ and ‘Chilled Reggae’ were all among Spotify’s official playlist offerings, alongside collections like ‘Chillin’ on a Dirt Road,’ ‘lofi chill,’ and ‘Calm.'” (page 45). This is partly not the fault of Spotify; YouTube expanded the availability of live streams in 2013 and it resulted in plenty of samey chill hop stations. In a 2018 New York Times article about these nonstop live-streams, Jonah E. Bromwich writes:

Channels like College Music, ChilledCow, Chillhop Music and others are unlikely to have a broad impact on the music industry. But they represent an underground alternative to the streaming hegemony of Spotify and Apple Music. The industry commentator Bob Lefsetz said that while the stations were not likely to become a lucrative endeavor, they were a way for members of the public to seize power back from cultural gatekeepers.

Instead of being predominantly inspired or encouraged by Spotify, it is possible the growth of the background music genre is something the company is instead taking advantage of — and take advantage it did.

Whether on YouTube or Spotify, the beat-makers behind these tracks are loosely inspired by artists like J Dilla, but they have coalesced around a distinctly hazy and slowed-down instrumental palette. That these tracks are deliberately indistinct has led to Spotify commissioning low-royalty generic tracks and, as Pelly writes, this passivity is an area “where the imminent A.I. infiltration of music was most feasible: the replacement of lean-back mood music” (page 132).

All told, it sure sounds like Spotify aligned its recommendations to compel users into filling silence with music featureless enough it could be replicated by what are, in effect, stock tracks. If this was a deliberate strategy to allow Spotify to have lower royalty expenses, it has had a mixed effect. Setting aside the ongoing popularity of big pop stars like Taylor Swift and Justin Bieber — I would love to know how much of Spotify’s revenue is sent to those two artists alone — the rise of streaming also coincided with the explosion of in-your-face K-pop groups, renewed interest in rock music, and revivals of funk and disco. These are not the kinds of passive listening genres Pelly seems so concerned with.

That is not to say Spotify plays no influence in what is popular. Just as what was made popular on the radio brought a wave of imitators, so too is the case for an era where streaming is where most people listen to music. None of this is new. A streaming listener’s context is often quite similar to a radio listener’s, too. Pelly’s exploration of the chilled-out Spotify playlist and lean-back listener reads, to me, with considerable disdain. But that kind of passive listening was common in the radio days. People put music on in the car and at work all the time. My parents used to put a C.D. on when they were cooking dinner. I do not think they were captivated in that moment by the sounds of Genesis or the Police. I was listening to music while reading this book and writing this article. Sometimes, an album will get played as a background to other tasks; any musician is surely aware of this.

Perhaps you, too, are now seeing what I began to understand. What Pelly keeps gesturing at throughout this book — but never quite reaches — is that the problems Spotify faces are similar to that of any massive two-sided platform. Pick your case study of any of the large tech companies and you can find parallels in Spotify. It has hundreds of millions of subscribers; everything it does is at vast scale.

It has privacy problems. Pelly dedicates a chapter to “Streaming as Surveillance”, pointing to Spotify’s participation in the data broker and ad tech economy. Spotify suggests its ads can be targeted based on users’ moods correlated with playlist and song data. This, like so many other ad tech sales pitches, is likely an inflated claim with only limited success. Yet it is also a little creepy to consider it is what Spotify aspires its ad product to be.

Spotify, like many others, faces moderation problems. Spotify does not want to put too many limits on what music is accepted. In the best of circumstances, this makes it possible for a nascent artist to rise from obscurity and start a career. But there are financial incentives to gaming the system. There are people who will follow trends, and even commit outright fraud manually or with A.I.-generated material. This is true for other broadly available revenue machines — Google Ads and YouTube are two that immediately spring to mind. In an attempt to disincentivize these behaviours and reduce Spotify’s costs, the company announced in November 2023 it would stop paying royalties for tracks with fewer than one thousand annual streams. Pelly writes this “was part of a campaign waged by Universal Music Group to revamp streaming in its favor” (page 155). When Spotify rolled out this new royalty structure, UMG CEO Lucian Grainge bade good riddance to “merchants of garbage […] no one actually wants to listen to” (page 157). How much it actually hurts low-effort spammers is a good question, but it impacts legitimate indie artists — what Grainge calls “garbage” — for whom Spotify now presents no advantage over piracy.

I would not be so presumptuous as to say that is what this book ought to have been but, as a longtime reader of Pelly’s articles about the subject, I was frustrated by “Mood Machine”. It is the kind of book I wish would be taken apart and reassembled for better flow and a more coherent structure. Spotify and the streaming model have problems. “Mood Machine” identifies many of them. But the money quote — the one that cut through everything for me — is from an anonymous former Spotify employee (page 167):

“If Spotify is guilty of something, they had the opportunity at one point to change the way value was exhanged in the music industry, and they decided not to,” the former employee told me. “So it’s just upholding the way that things have always been.”

We treat art terribly. It is glamorous and alluring, but it is ultimately a plaything of the rich. The people who make money in art, no matter the discipline, are those responsible for its distribution, management, and sale. Those creating the actual work that enriches our lives too often get the scraps, unless they have enough cachet to dictate the terms in their favour.

Spotify is just another layer in the chain; another place that makes far more money than artists ever will. An artist understands they are signing up for a job with unpredictable pay, but Spotify’s particular structure makes it even more opaque.

The four biggest audio streaming platforms — Spotify, YouTube, Tencent, and Apple Music are the top-down force pushing culture in a particular direction, a level of influence Clear Channel’s executives could have only hoped for in its heyday. Streaming can help people learn about music they have never heard before. But it is not very effective as an artistic conduit. It is an ad-supported platform operating at global scale, much like a handful of other large tech companies, and it faces similar problems.

Yet none of them are as essentially tied to the distribution of art as is Spotify. It is a shame it did not create something to upend the status quo and made more artists more money. I guess part of the reason for that could be because its co-founders saw music as one of several interchangeable user acquisition strategies to sell advertisements — you know, for the love of art and music.

Documents Show How Police Track Cars Using Subscription Features ⇥ wired.com

Dell Cameron, Wired:

A cache of more than two dozen police records recently reviewed by WIRED show US law enforcement agencies regularly trained on how to take advantage of “connected cars,” with subscription-based features drastically increasing the amount of data that can be accessed during investigations. The records make clear that law enforcement’s knowledge of the surveillance far exceeds that of the public and reveal how corporate policies and technologies — not the law — determine driver privacy.

On Bluesky, Cameron published a screenshot of what is available by car make and model year “as a treat”. Owners of Ferraris will be delighted to know they are not on this list.

Cameron’s reporting indicates law enforcement is able to obtain information from automakers and cellular network operators. Four years ago, Joseph Cox, then at Vice, reported on capabilities offered by the Ulysses Group, previously linked. Then, last year, Kashmir Hill of the New York Times reported the sharing of data by General Motors to insurance companies and data brokers. Each of these depicts an entirely different avenue by which individual vehicles may be surveilled, stockpiling data which may be produced without a warrant.

The Global Surveillance Free-for-All in Mobile Ad Data ⇥ krebsonsecurity.com

Brian Krebs:

In an interview, Atlas said a private investigator they hired was offered a free trial of Babel Street, which the investigator was able to use to determine the home address and daily movements of mobile devices belonging to multiple New Jersey police officers whose families have already faced significant harassment and death threats.

[…]

Atlas says the Babel Street trial period allowed its investigator to find information about visitors to high-risk targets such as mosques, synagogues, courtrooms and abortion clinics. In one video, an Atlas investigator showed how they isolated mobile devices seen in a New Jersey courtroom parking lot that was reserved for jurors, and then tracked one likely juror’s phone to their home address over several days.

Krebs describes a staggering series of demonstrations by the investigator for Atlas, plaintiff in a suit against Babel Street: precise location tracking of known devices, or dragnet-style tracking of a cluster of devices, basically anywhere. If you or I collected device locations and shared it with others, it would be rightly seen as creepy — at the very least. Yet these intrusive behaviours have been normalized. They are not. What they are doing ought to be criminal.

It is not just Babel Street. Other names have popped up over the years, including Venntel and Fog Data Science. Jack Poulson, who writes All-Source Intelligence, has an update on the former:

According to a public summary of a contract signed in early August, the U.S. Federal Trade Commission has opened an inquiry into the commercial cellphone location-tracking data broker Venntel and its parent company Gravy Analytics. […]

Gravy Analytics’ data, via Venntel, is apparently one of the sources for Babel Street’s tracking capabilities.

You might remember Babel Street; I have linked to several stories about the company. This reporting was most often done by Byron Tau, then at the Wall Street Journal, and Joseph Cox, then at Vice. Tau wrote a whole book about the commercial surveillance apparatus. Both reporters were also invited to the same demo as Krebs saw; Tau’s story, at Notus, is login-walled:

The demonstration offers a rare look into how easily identifiable people are in these location-based data sets, which brokers claim are “anonymized.”

Such claims do not hold up to scrutiny. The tools in the hands of capable researchers, including law enforcement, can be used to identify specific individuals in many cases. Babel’s tool is explicitly marketed to intelligence analysts and law enforcement officers as a commercially available phone-tracking capability — a way to do a kind of surveillance that once required a search warrant inside the U.S. or was conducted by spy agencies when done outside the U.S.

Cox now writes at 404 Media:

Atlas also searched a school in Philadelphia, which returned nearly 7,000 devices. Due to the large number of phones, it is unlikely that these only include adult teachers, meaning that Babel Street may be holding onto data belonging to children too.

All these stories are worth your time. Even if you are already aware of this industry. Even if you remember that vivid New York Times exploration of an entirely different set of data brokers published six years ago. Even if you think Apple is right to allow users to restrict access to personal data.

This industry is still massive and thriving. It is still embedded in applications on many of our phones, by way of third-party SDKs for analytics, advertising, location services, and more. And it is deranged that the one government that can actually do something about this — the United States — is doing so one company and one case at a time. Every country should be making it illegal to do what Babel Street is capable of. But perhaps it is too rich a source.

A Cartoon Butt Clenching a Bar of Soap ⇥ arstechnica.com

Nate Anderson, Ars Technica:

The great irony of online advertising these days is that it’s often claimed to be “targeted,” mining our personal and demographic information to serve us the ads that we allegedly want to see. Wouldn’t I prefer to view ads “relevant to my interests”? Maybe. But I can say with confidence that after two decades of being “extremely online” for work, the number of ads I have voluntarily and enthusiastically clicked upon must number in the low double digits.

Instead, the engines powering these ad networks continue to bombard me with two kinds of ads: 1) those that are wholly irrelevant to my interests and 2) those that are relevant to my interests because they display the exact product I once looked at in some online store. Ad targeting companies may “know a lot about me,” but they don’t know me in any truly useful way.

Ad tech companies will never have enough information about us to ensure truly reliable targeting, but they have more than enough to be a privacy nightmare unlike anything the world has seen before.

Update: This felt familiar to me. Four years ago, a similar butt-themed ad — this time for pyjamas with a flap — followed Vice writer Kate Dries around the web.

Killing Time for TikTok

Finally. The government of the United States finally passed a law that would allow it to force the sale of, or ban, software and websites from specific countries of concern. The target is obviously TikTok — it says so right in its text — but crafty lawmakers have tried to add enough caveats and clauses and qualifiers to, they hope, avoid it being characterized as a bill of attainder, and to permit future uses. This law is very bad. It is an ineffective and illiberal position that abandons democratic values over, effectively, a single app. Unfortunately, TikTok panic is a very popular position in the U.S. and, also, here in Canada.

The adversaries the U.S. is worried about are the “covered nations” defined in 2018 to restrict the acquisition by the U.S. of key military materials from four countries: China, Iran, North Korea, and Russia. The idea behind this definition was that it was too risky to procure magnets and other important components of, say, missiles and drones from a nation the U.S. considers an enemy, lest those parts be compromised in some way. So the U.S. wrote down its least favourite countries for military purposes, and that list is now being used in a bill intended to limit TikTok’s influence.

According to the law, it is illegal for any U.S. company to make available TikTok and any other ByteDance-owned app — or any app or website deemed a “foreign adversary controlled application” — to a user in the U.S. after about a year unless it is sold to a company outside the covered countries, and with an ownership stake less than twenty percent from any combination of entities in those four named countries. Theoretically, the parent company could be based nearly anywhere in the world; practically, if there is a buyer, it will likely be from the U.S. because of TikTok’s size. Also, the law specifically exempts e-commerce apps for some reason.

This could be interpreted as either creating an isolated version specifically for U.S. users or, as I read it, moving the global TikTok platform to a separate organization not connected to ByteDance or China.1 ByteDance’s ownership is messy, though mostly U.S.-based, but politicians worried about its Chinese origin have had enough, to the point they are acting with uncharacteristic vigour. The logic seems to be that it is necessary for the U.S. government to influence and restrict speech in order to prevent other countries from influencing or restricting speech in ways the U.S. thinks are harmful. That is, the problem is not so much that TikTok is foreign-owned, but that it has ownership ties to a country often antithetical to U.S. interests. TikTok’s popularity might, it would seem, be bad for reasons of espionage or influence — or both.

Power

So far, I have focused on the U.S. because it is the country that has taken the first step to require non-Chinese control over TikTok — at least for U.S. users but, due to the scale of its influence, possibly worldwide. It could force a business to entirely change its ownership structure. So it may look funny for a Canadian to explain their views of what the U.S. ought to do in a case of foreign political interference. This is a matter of relevance in Canada as well. Our federal government raised the alarm on “hostile state-sponsored or influenced actors” influencing Canadian media and said it had ordered a security review of TikTok. There was recently a lengthy public inquiry into interference in Canadian elections, with a special focus on China, Russia, and India. Clearly, the popularity of a Chinese application is, in the eyes of these officials, a threat.

Yet it is very hard not to see the rush to kneecap TikTok’s success as a protectionist reaction to shaking the U.S. dominance of consumer technologies, as convincingly expressed by Paris Marx at Disconnect:

In Western discourses, China’s internet policies are often positioned solely as attempts to limit the freedoms of Chinese people — and that can be part of the motivation — but it’s a politically convenient explanation for Western governments that ignores the more important economic dimension of its protectionist approach. Chinese tech is the main competitor to Silicon Valley’s dominance today because China limited the ability of US tech to take over the Chinese market, similar to how Japan and South Korea protected their automotive and electronics industries in the decades after World War II. That gave domestic firms the time they needed to develop into rivals that could compete not just within China, but internationally as well. And that’s exactly why the United States is so focused not just on China’s rising power, but how its tech companies are cutting into the global market share of US tech giants.

This seems like one reason why the U.S. has so aggressively pursued a divestment or ban since TikTok’s explosive growth in 2019 and 2020. On its face it is similar to some reasons why the E.U. has regulated U.S. businesses that have, it argues, disadvantaged European competitors, and why Canadian officials have tried to boost local publications that have seen their ad revenue captured by U.S. firms. Some lawmakers make it easy to argue it is a purely xenophobic reaction, like Senator Tom Cotton, who spent an exhausting minute questioning TikTok’s Singaporean CEO Shou Zi Chew about where he is really from. But I do not think it is entirely a protectionist racket.

A mistake I have made in the past — and which I have seen some continue to make — is assuming those who are in favour of legislating against TikTok are opposed to the kinds of dirty tricks it is accused of on principle. This is false. Many of these same people would be all too happy to allow U.S. tech companies to do exactly the same. I think the most generous version of this argument is one in which it is framed as a dispute between the U.S. and its democratic allies, and anxieties about the government of China — ByteDance is necessarily connected to the autocratic state — spreading messaging that does not align with democratic government interests. This is why you see few attempts to reconcile common objections over TikTok with the quite similar behaviours of U.S. corporations, government arms, and intelligence agencies. To wit: U.S.-based social networks also suggest posts with opaque math which could, by the same logic, influence elections in other countries. They also collect enormous amounts of personal data that is routinely wiretapped, and are required to secretly cooperate with intelligence agencies. The U.S. is not authoritarian as China is, but the behaviours in question are not unique to authoritarians. Those specific actions are unfortunately not what the U.S. government is objecting to. What it is disputing, in a most generous reading, is a specifically antidemocratic government gaining any kind of influence.

Espionage and Influence

It is easiest to start by dismissing the espionage concerns because they are mostly misguided. The peek into Americans’ lives offered by TikTok is no greater than that offered by countless ad networks and data brokers — something the U.S. is also trying to restrict more effectively through a comprehensive federal privacy law. So long as online advertising is dominated by a privacy-hostile infrastructure, adversaries will be able to take advantage of it. If the goal is to restrict opportunities for spying on people, it is idiotic to pass legislation against TikTok specifically instead of limiting the data industry.

But the charge of influence seems to have more to it, even though nobody has yet shown that TikTok is warping users’ minds in a (presumably) pro-China direction. Some U.S. lawmakers described its danger as “theoretical”; others seem positively terrified. There are a few different levels to this concern: are TikTok users uniquely subjected to Chinese government propaganda? Is TikTok moderated in a way that boosts or buries videos to align with Chinese government views? Finally, even if both of these things are true, should the U.S. be able to revoke access to software if it promotes ideologies or viewpoints — and perhaps explicit propaganda? As we will see, it looks like TikTok sometimes tilts in ways beneficial — or, at least, less damaging — to Chinese government interests, but there is no evidence of overt government manipulation and, even if there were, it is objectionable to require it to be owned by a different company or ban it.

The main culprit, it seems, is TikTok’s “uncannily good” For You feed that feels as though it “reads your mind”. Instead of users telling TikTok what they want to see, it just begins showing videos and, as people use the app, it figures out what they are interested in. How it does this is not actually that mysterious. A 2021 Wall Street Journal investigation found recommendations were made mostly based on how long you spent watching each video. Deliberate actions — like sharing and liking — play a role, sure, but if you scroll past videos of people and spend more time with a video of a dog, it learns you want dog videos.

That is not so controversial compared to the opacity in how TikTok decides what specific videos are displayed and which ones are not. Why is this particular dog video in a user’s feed and not another similar one? Why is it promoting videos reflecting a particular political viewpoint or — so a popular narrative goes — burying those with viewpoints uncomfortable for its Chinese parent company? The mysterious nature of an algorithmic feed is the kind of thing into which you can read a story of your choosing. A whole bunch of X users are permanently convinced they are being “shadow banned” whenever a particular tweet does not get as many likes and retweets as they believe it deserved, for example, and were salivating at the thought of the company releasing its ranking code to solve a nonexistent mystery. There is a whole industry of people who say they can get your website to Google’s first page for a wide range of queries using techniques that are a mix of plausible and utterly ridiculous. Opaque algorithms make people believe in magic. An alarmist reaction to TikTok’s feed should be expected particularly as it was the first popular app designed around entirely recommended material instead of personal or professional connections. This has now been widely copied.

The mystery of that feed is a discussion which seems to have been ongoing basically since the 2018 merger of Musical.ly and TikTok, escalating rapidly to calls for it to be separated from its Chinese owner or banned altogether. In 2020, the White House attempted to force a sale by executive order. In response, TikTok created a plan to spin off an independent entity, but nothing materialized from this tense period.

March 2023 brought a renewed effort to divest or ban the platform. Chew, TikTok’s CEO, was called to a U.S. Congressional hearing and questioned for hours, to little effect. During that hearing, a report prepared for the Australian government was cited by some of the lawmakers, and I think it is a telling document. It is about eighty pages long — excluding its table of contents, appendices, and citations — and shows several examples of Chinese government influence on other products made by ByteDance. However, the authors found no such manipulation on TikTok itself, leading them to conclude:

In our view, ByteDance has demonstrated sufficient capability, intent, and precedent in promoting Party propaganda on its Chinese platforms to generate material risk that they could do the same on TikTok.

“They could do the same”, emphasis mine. In other words, if they had found TikTok was boosting topics and videos on behalf of the Chinese government, they would have said so — so they did not. The closest thing I could find to a covert propaganda campaign on TikTok anywhere in this report is this:

The company [ByteDance] tried to do the same on TikTok, too: In June 2022, Bloomberg reported that a Chinese government entity responsible for public relations attempted to open a stealth account on TikTok targeting Western audiences with propaganda”. [sic]

If we follow the Bloomberg citation — shown in the report as a link to the mysterious Archive.today site — the fuller context of the article by Olivia Solon disproves the impression you might get from reading the report:

In an April 2020 message addressed to Elizabeth Kanter, TikTok’s head of government relations for the UK, Ireland, Netherlands and Israel, a colleague flagged a “Chinese government entity that’s interested in joining TikTok but would not want to be openly seen as a government account as the main purpose is for promoting content that showcase the best side of China (some sort of propaganda).”

The messages indicate that some of ByteDance’s most senior government relations team, including Kanter and US-based Erich Andersen, Global Head of Corporate Affairs and General Counsel, discussed the matter internally but pushed back on the request, which they described as “sensitive.” TikTok used the incident to spark an internal discussion about other sensitive requests, the messages state.

This is the opposite conclusion to how this story was set up in the report. Chinese government public relations wanted to set up a TikTok account without any visible state connection and, when TikTok management found out about this, it said no. This Bloomberg article makes TikTok look good in the face of government pressure, not like it capitulates. Yes, it is worth being skeptical of this reporting. Yet if TikTok acquiesced to the government’s demands, surely the report would provide some evidence.

While this report for the Australian Senate does not show direct platform manipulation, it does present plenty of examples where it seems like TikTok may be biased or self-censoring. Its authors cite stories from the Washington Post and Vice finding posts containing hashtags like #HongKong and #FreeXinjiang returned results favourable to the official Chinese government position. Sometimes, related posts did not appear in search results, which is not unique to TikTok — platforms regularly use crude search term filtering to restrict discovery for lots of reasons. I would not be surprised if there were bias or self-censorship to blame for TikTok minimizing the visibility of posts critical of the subjugation of Uyghurs in China. However, it is basically routine for every social media product to be accused of suppression. The Markup found different types of posts on Instagram, for example, had captions altered or would no longer appear in search results, though it is unclear to anyone why that is the case. Meta said it was a bug, an explanation also offered frequently by TikTok.

The authors of the Australian report conducted a limited quasi-study comparing results for certain topics on TikTok to results on other social networks like Instagram and YouTube, again finding a handful of topics which favoured the government line. But there was no consistent pattern, either. Search results for “China military” on Instagram were, according to the authors, “generally flattering”, and X searches for “PLA” scarcely returned unfavourable posts. Yet results on TikTok for “China human rights”, “Tianamen”, and “Uyghur” were overwhelmingly critical of Chinese official positions.

The Network Contagion Research Institute published its own report in December 2023, similarly finding disparities between the total number of posts with specific hashtags — like #DalaiLama and #TiananmenSquare — on TikTok and Instagram. However, the study contained some pretty fundamental errors, as pointed out by — and I cannot believe I am citing these losers — the Cato Institute. The study’s authors compared total lifetime posts on each social network and, while they say they expect 1.5–2.0× the posts on Instagram because of its larger user base, they do not factor in how many of those posts could have existed before TikTok was even launched. Furthermore, they assume similar cultures and a similar use of hashtags on each app. But even benign hashtags have ridiculous differences in how often they are used on each platform. There are, as of writing, 55.3 million posts tagged “#ThrowbackThursday” on Instagram compared to 390,000 on TikTok, a ratio of 141:1. If #ThrowbackThursday were part of this study, the disparity on the two platforms would rank similarly to #Tiananmen, one of the greatest in the Institute’s report.

The problem with most of these complaints, as their authors acknowledge, is that there is a known input and a perceived output, but there are oh-so-many unknown variables in the middle. It is impossible to know how much of what we see is a product of intentional censorship, unintentional biases, bugs, side effects of other decisions, or a desire to cultivate a less stressful and more saccharine environment for users. A report by Exovera (PDF) prepared for the U.S.–China Economic and Security Review Commission indicates exactly the latter: “TikTok’s current content moderation strategy […] adheres to a strategy of ‘depoliticization’ (去政治化) and ‘localization’ (本土化) that seeks to downplay politically controversial speech and demobilize populist sentiment”, apparently avoiding “algorithmic optimization in order to promote content that evangelizes China’s culture as well as its economic and political systems” which “is liable to result in backlash”. Meta, on its own platforms, said it would not generally suggest “political” posts to users but did not define exactly what qualifies. It said its goal in limiting posts on social issues was because of user demand, but these types of posts have been difficult to moderate. A difference in which posts are found on each platform for specific search terms is not necessarily reflective of government pressure, deliberate or not. Besides, it is not as though there is no evidence for straightforward propaganda on TikTok. One just needs to look elsewhere to find it.

Propaganda

The Office of the Director of National Intelligence recently released its annual threat assessment summary (PDF). It is unclassified and has few details, so the only thing it notes about TikTok is “accounts run by a PRC propaganda arm reportedly targeted candidates from both political parties during the U.S. midterm election cycle in 2022”. It seems likely to me this is a reference to this article in Forbes, though this is a guess as there are no citations. The state-affiliated TikTok account in question — since made private — posted a bunch of news clips which portray the U.S. in an unflattering light. There is a related account, also marked as state-affiliated, which continues to post the same kinds of videos. It has over 33,000 followers, which sounds like a lot, but each post is typically getting only a few hundred views. Some have been viewed thousands of times, others as little as thirteen times as of writing — on a platform with exaggerated engagement numbers. Nonetheless, the conclusion is obvious: these accounts are government propaganda, and TikTok willingly hosts them.

But that is something it has in common with all social media platforms. The Russian RT News network and China’s People’s Daily newspaper have X and Facebook accounts with follower counts in the millions. Until recently, the North Korean newspaper Uriminzokkiri operated accounts on Instagram and X. It and other North Korean state-controlled media used to have YouTube channels, too, but they were shut down by YouTube in 2017 — a move that was protested by academics studying the regime’s activities. The irony of U.S.-based platforms helping to disseminate propaganda from the country’s adversaries is that it can be useful to understand them better. Merely making propaganda available — even promoting it — is a risk and also a benefit to generous speech permissions.

The DNI’s unclassified report has no details about whether TikTok is an actual threat, and the FBI has “nothing to add” in response to questions about whether TikTok is currently doing anything untoward. More secretive information was apparently provided to U.S. lawmakers ahead of their March vote and, though few details of what, exactly, was said, several were not persuaded by what they heard, including Rep. Sara Jacobs of California:

As a member of both the House Armed Services and House Foreign Affairs Committees, I am keenly aware of the threat that PRC information operations can pose, especially as they relate to our elections. However, after reviewing the intelligence, I do not believe that this bill is the answer to those threats. […] Instead, we need comprehensive data privacy legislation, alongside thoughtful guardrails for social media platforms – whether those platforms are funded by companies in the PRC, Russia, Saudi Arabia, or the United States.

Lawmakers like Rep. Jacobs were an exception among U.S. Congresspersons who, across party lines, were eager to make the case against TikTok. Ultimately, the divest-or-ban bill got wrapped up in a massive and politically popular spending package agreed to by both chambers of Congress. Its passage was enthusiastically received by the White House and it was signed into law within hours. Perhaps that outcome is the democratic one since polls so often find people in the U.S. support a sale or ban of TikTok.

I get it: TikTok scoops up private data, suggests posts based on opaque criteria, its moderation appears to be susceptible to biases, and it is a vehicle for propaganda. But you could replace “TikTok” in that sentence with any other mainstream social network and it would be just as true, albeit less scary to U.S. allies on its face.

A Principled Objection

Forcing TikTok to change its ownership structure whether worldwide or only for a U.S. audience is a betrayal of liberal democratic principles. To borrow from Jon Stewart, “if you don’t stick to your values when they’re being tested, they’re not values, they’re hobbies”. It is not surprising that a Canadian intelligence analysis specifically pointed out how those very same values are being taken advantage of by bad actors. This is not new. It is true of basically all positions hostile to democracy — from domestic nationalist groups in Canada and the U.S., to those which originate elsewhere.

Julian G. Ku, for China File, offered a seemingly reasonable rebuttal to this line of thinking:

This argument, while superficially appealing, is wrong. For well over one hundred years, U.S. law has blocked foreign (not just Chinese) control of certain crucial U.S. electronic media. The Protect Act [sic] fits comfortably within this long tradition.

Yet this counterargument falls apart both in its details and if you think about its further consequences. As Martin Peers writes at the Information, the U.S. does not prohibit all foreign ownership of media. And governing the internet like public airwaves gets way more complicated if you stretch it any further. Canada has broadcasting laws, too, and it is not alone. Should every country begin requiring social media platforms comply with laws designed for ownership of broadcast media? Does TikTok need disconnected local versions of its product in each country in which it operates? It either fundamentally upsets the promise of the internet, or it is mandating the use of protocols instead of platforms.

It also looks hypocritical. Countries with a more authoritarian bent and which openly censor the web have responded to even modest U.S. speech rules with mockery. When RT America — technically a U.S. company with Russian funding — was required to register as a foreign agent, its editor-in-chief sarcastically applauded U.S. free speech standards. The response from Chinese government officials and media outlets to the proposed TikTok ban has been similarly scoffing. Perhaps U.S. lawmakers are unconcerned about the reception of their policies by adversarial states, but it is an indicator of how these policies are being portrayed in these countries — a real-life “we are not so different, you and I” setup — that, while falsely equivalent, makes it easy for authoritarian states to claim that democracies have no values and cannot work. Unless we want to contribute to the fracturing of the internet — please, no — we cannot govern social media platforms by mirroring policies we ostensibly find repellant.

The way the government of China seeks to shape the global narrative is understandably concerning given its poor track record on speech freedoms. An October 2023 U.S. State Department “special report” (PDF) explored several instances where it boosted favourable narratives, buried critical ones, and pressured other countries — sometimes overtly, sometimes quietly. The government of China and associated businesses reportedly use social media to create the impression of dissent toward human rights NGOs, and apparently everything from university funding to new construction is a vector for espionage. On the other hand, China is terribly ineffective in its disinformation campaigns, and many of the cases profiled in that State Department report end in failure for the Chinese government initiative. In Nigeria, a pitch for a technologically oppressive “safe city” was rejected; an interview published in the Jerusalem Post with Taiwan’s foreign minister was not pulled down despite threats from China’s embassy in Israel. The report’s authors speculate about “opportunities for PRC global censorship”. But their only evidence is a “list [maintained by ByteDance] identifying people who were likely blocked or restricted” from using the company’s many platforms, though the authors can only speculate about its purpose.

The problem is that trying to address this requires better media literacy and better recognition of propaganda. That is a notoriously daunting problem. We are exposed to a more destabilizing cocktail of facts and fiction, but there is declining trust in experts and institutions to help us sort it out. Trying to address TikTok as a symptomatic or even causal component of this is frustratingly myopic. This stuff is everywhere.

Also everywhere is corporate propaganda arguing regulations would impede competition in a global business race. I hate to be mean by picking on anyone in particular, but a post from Om Malik has shades of this corporate slant. Malik is generally very good on the issues I care about, but this is not one we appear to agree on. After a seemingly impressed observation of how quickly Chinese officials were able to eject popular messaging apps from the App Store in the country, Malik compares the posture of each country’s tech industries:

As an aside, while China considers all its tech companies (like Bytedance) as part of its national strategic infrastructure, the United States (and its allies) think of Apple and other technology companies as public enemies.

This is laughable. Presumably, Malik is referring to the chillier reception these companies have faced from lawmakers, and antitrust cases against Amazon, Apple, Google, and Meta. But that tougher impression is softened by the U.S. government’s actual behaviour. When the E.U. announced the Digital Markets Act and Digital Services Act, U.S. officials sprang to the defence of tech companies. Even before these cases, Uber expanded in Europe thanks in part to its close relationship with Obama administration officials, as Marx pointed out. The U.S. unquestionably sees its tech industry dominance as a projection of its power around the world, hardly treating those companies as “public enemies”.

Far more explicit were the narratives peddled by lobbyists from Targeted Victory in 2022 about TikTok’s dangers, and American Edge beginning in 2020 about how regulations will cause the U.S. to become uncompetitive with China and allow TikTok to win. Both organizations were paid by Meta to spread those messages; the latter was reportedly founded after a single large contribution from Meta. Restrictions on TikTok would obviously be beneficial to Meta’s business.

If you wanted to boost the industry — and I am not saying Malik is — that is how you would describe the situation: the U.S. is fighting corporations instead of treating them as pals to win this supposed race. It is not the kind of framing one uses if they wanted to dissuade people from the notion this is a protectionist dispute over the popularity of TikTok. But it is the kind of thing you hear from corporations via their public relations staff and lobbyists, which gets trickled into public conversation.

This Is Not a TikTok Problem

TikTok’s divestment would not be unprecedented. The Committee on Foreign Investment in the United States — henceforth, CFIUS, pronounced “siff-ee-us” — demanded, after a 2019 review, that Beijing Kunlun Tech Co Ltd sell Grindr. CFIUS concluded the risk to users’ private data was too great for Chinese ownership given Grindr’s often stigmatized and ostracized user base. After its sale, now safe in U.S. hands, a priest was outed thanks to data Grindr had been selling since before it was acquired by the Chinese firm, and it is being sued for allegedly sharing users’ HIV status with third parties. Also, because it transacts with data brokers, it potentially still leaks users’ private information to Chinese companies (PDF), apparently violating the fundamental concern triggering this divestment.

Perhaps there is comfort in Grindr’s owner residing in a country where same-sex marriage is legal rather than in one where it is not. I think that makes a lot of sense, actually. But there remain plenty of problems unaddressed by its sale to a U.S. entity.

Similarly, this U.S. TikTok law does not actually solve potential espionage or influence for a few reasons. The first is that it has not been established that either are an actual problem with TikTok. Surely, if this were something we ought to be concerned about, there would be a pattern of evidence, instead of what we actually have which is a fear something bad could happen and there would be no way to stop it. But many things could happen. I am not opposed to prophylactic laws so long as they address reasonable objections. Yet it is hard not to see this law as an outgrowth of Cold War fears over leaflets of communist rhetoric. It seems completely reasonable to be less concerned about TikTok specifically while harbouring worries about democratic backsliding worldwide and the growing power of authoritarian states like China in international relations.

Second, the Chinese government does not need local ownership if it wants to exert pressure. The world wants the country’s labour and it wants its spending power, so businesses comply without a fight, and often preemptively. Hollywood films are routinely changed before, during, and after production to fit the expectations of state censors in China, a pattern which has been pointed out using the same “Red Dawn” anecdote in story after story after story. (Abram Dylan contrasted this phenomenon with U.S. military cooperation.) Apple is only too happy to acquiesce to the government’s many demands — see the messaging apps issue mentioned earlier — including, reportedly, in its media programming. Microsoft continues to operate Bing in China, and its censorship requirements have occasionally spilled elsewhere. Economic leverage over TikTok may seem different because it does not need access to the Chinese market — TikTok is banned in the country — but perhaps a new owner would be reliant upon China.

Third, the law permits an ownership stake no greater than twenty percent from a combination of any of the “covered nations”. I would be shocked if everyone who is alarmed by TikTok today would be totally cool if its parent company were only, say, nineteen percent owned by a Chinese firm.

If we are worried about bias in algorithmically sorted feeds, there should be transparency around how things are sorted, and more controls for users including wholly opting out. If we are worried about privacy, there should be laws governing the collection, storage, use, and sharing of personal information. If ownership ties to certain countries is concerning, there are more direct actions available to monitor behaviour. I am mystified why CFIUS and TikTok apparently abandoned (PDF) a draft agreement that would give U.S.-based entities full access to the company’s systems, software, and staff, and would allow the government to end U.S. access to TikTok at a moment’s notice.

Any of these options would be more productive than this legislation. It is a law which empowers the U.S. president — whoever that may be — to declare the owner of an app with a million users a “covered company” if it is from one of those four nations. And it has been passed. TikTok will head to court to dispute it on free speech grounds, and the U.S. may respond by justifying its national security concerns.

Obviously, the U.S. government has concerns about the connections between TikTok, ByteDance, and the government of China, which have been extensively reported. Rest of World says ByteDance put pressure on TikTok to improve its financial performance and has taken greater control by bringing in management from Douyin. The Wall Street Journal says U.S. user data is not fully separated. And, of course, Emily Baker-White has reported — first for Buzzfeed News and now for Forbes — a litany of stories about TikTok’s many troubling behaviours, including spying on her. TikTok is a well scrutinized app and reporters have found conduct that has understandably raised suspicions. But virtually all of these stories focus on data obtained from users, which Chinese agencies could do — and probably are doing — without relying on TikTok. None of them have shown evidence that TikTok’s suggestions are being manipulated at the behest or demand of Chinese officials. The closest they get is an article from Baker-White and Iain Martin which alleges TikTok “served up a flood of ads from Chinese state propaganda outlets”, yet waiting until the third-to-last paragraph before acknowledging “Meta and Google ad libraries show that both platforms continue to promote pro-China narratives through advertising”. All three platforms label state-run media outlets, albeit inconsistently. Meanwhile, U.S.-owned X no longer labels any outlets with state editorial control. It is not clear to me that TikTok would necessarily operate to serve the best interests of the U.S. even if it was owned by some well-financed individual or corporation based there.

For whatever it is worth, I am not particularly tied to the idea that the government of China would not use TikTok as a vehicle for influence. The government of China is clearly involved in propaganda efforts both overt and covert. I do not know how much of my concerns are a product of living somewhere with a government and a media environment that focuses intently on the country as particularly hostile, and not necessarily undeservedly. The best version of this argument is one which questions the platform’s possible anti-democratic influence. Yes, there are many versions of this which cross into moral panic territory — a new Red Scare. I have tried to put this in terms of a more reasonable discussion, and one which is not explicitly xenophobic or envious. But even this more even-handed position is not well served by the law passed in the U.S., one which was passed without evidence of influence much more substantial than some choice hashtag searches. TikTok’s response to these findings was, among other things, to limit its hashtag comparison tool, which is not a good look. (Meta is doing basically the same by shutting down CrowdTangle.)

I hope this is not the beginning of similar isolationist policies among democracies worldwide, and that my own government takes this opportunity to recognize the actual privacy and security threats at the heart of its own TikTok investigation. Unfortunately, the head of CSIS is really leaning on the espionage angle. For years, the Canadian government has been pitching sorely needed updates to privacy legislation, and it would be better to see real progress made to protect our private data. We can do better than being a perpetual recipient of decisions made by other governments. I mean, we cannot do much — we do not have the power of the U.S. or China or the E.U. — but we can do a little bit in our own polite Canadian way. If we are worried about the influence of these platforms, a good first step would be to strengthen the rights of users. We can do that without trying to governing apps individually, or treating the internet like we do broadcasting.

To put it more bluntly, the way we deal with a possible TikTok problem is by recognizing it is not a TikTok problem. If we care about espionage or foreign influence in elections, we should address those concerns directly instead of focusing on a single app or company that — at worst — may be a medium for those anxieties. These are important problems and it is inexcusable to think they would get lost in the distraction of whether TikTok is individually blameworthy.

  1. Because this piece has taken me so long to write, a whole bunch of great analyses have been published about this law. I thought the discussion on “Decoder” was a good overview, especially since two of the three panelists are former lawyers. ↥︎

Joe Biden Signs Executive Order Intended to Restrict Data Sales to ‘Countries of Concern’ ⇥ whitehouse.gov

U.S. President Joe Biden today signed an executive order, previously covered, which intends to limit the sale and distribution of Americans’ sensitive data to “countries of concern”:

To address this threat and to take further steps with respect to the national emergency declared in Executive Order 13873, the order authorizes the Attorney General, in coordination with the Secretary of Homeland Security and in consultation with the heads of relevant agencies, to issue, subject to public notice and comment, regulations to prohibit or otherwise restrict the large-scale transfer of Americans’ personal data to countries of concern and to provide safeguards around other activities that can give those countries access to sensitive data. […]

According to a fact sheet (PDF) from the U.S. Department of Justice, six countries are being considered for restrictions: “China (including Hong Kong and Macau), Russia, Iran, North Korea, Cuba, and Venezuela”. The sensitive data which will be covered includes attributes like a person’s name, their location, and health and financial information.

This sounds great in theory, but it will be difficult to enforce in practice as data brokers operating outside the U.S. will not have the same restrictions. That is not to say it is useless. However, it is not as effective as creating conditions hostile to this kind of exploitation to begin with. You should not have to worry that your precise location is being shared with a data broker somewhere just because you checked the weather, nor should you need to be extremely diligent in reviewing the specific policies of each app or website you visit.

See Also: Dell Cameron, Wired.

Granular Private Data Is the Foundation of Targeted Advertising, Obviously

What people with Big Business Brains often like to argue about the unethical but wildly successful ad tech industry is that it is not as bad as it looks because your individual data does not have any real use or value. Ad tech vendors would not bother retaining such granular details because it is beneficial, they say, only in a more aggregated and generalized form.

The problem with this argument is that it keeps getting blown up by their demonstrable behaviour.1 For a recent example, consider Avast, an antivirus and security software provider, which installed to users’ computers a web browser toolbar that promised to protect against third-party tracking but, in actual fact, was collecting browsing history for — and you are not going to believe this — third-party tracking and advertising companies on behalf of the Avast subsidiary Jumpshot. It was supposed to be anonymized but, according to the U.S. Federal Trade Commission, this “proprietary algorithm” was so ineffective that Avast managed to collect six petabytes of revealing browsing history between 2014–2020. Then, it sold access (PDF):

[…] For example, from May 2017 to April 2019, Jumpshot granted LiveRamp, a data company that specializes in various identity services, a “world-wide license” to use consumers’ granular browsing information, including all clicks, timestamps, persistent identifiers, and cookie values, for a number of specified purposes. […]

One agreement between LiveRamp and Jumpshot stated that Jumpshot would use two services: first, “ID Syncing Services,” in which “LiveRamp and [Jumpshot] will engage in a synchronization and matching of identifiers,” and second, “Data Distribution Services,” in which “LiveRamp will ingest online Client Data and facilitate the distribution of Client’s Data (i.e., data segments and attributes of its users associated with Client IDs) to third-party platforms for the purpose of performing ad targeting and measurement.” These provisions permit the targeting of Avast consumers using LiveRamp’s ability to match Respondents’ persistent identifiers to LiveRamp’s own persistent identifiers, thereby associating data collected from Avast users with LiveRamp’s data.

We know these allegations due to the FTC’s settlement — though, I should say, these claims have not been proven, because Avast paid a $16.5 million penalty and said it would not use any of the data it collected “for advertising purposes”. The caveat makes this settlement feel a little incomplete to me. While there are other ways aggregated personal data can be used, like in market research, it does not seem Avast and Jumpshot were all that careful about obtaining consent when this software was first rolled out. When they did, the results were predictable (PDF):

Respondents had direct evidence that many consumers did not want their browsing information to be sold to third parties, even when they were told that the information would only be shared in de-identified form. In 2019, when Avast asked users of other Avast antivirus software to opt-in to the collection and sale of de-identified browsing information, fewer than 50% of consumers did so.

I am interpreting “fewer than 50%” as “between 40–49%”; if 18% of users had opted in, I expect the FTC would have said “fewer than 20%”. Most people do not want to be tracked. For comparison, this seems to be at the upper end of App Tracking Transparency opt-in rates.

I noted the LiveRamp connection when I first linked to investigations of Avast’s deceptive behaviour, though it seems Wolfie Christl beat me to the punch in December 2019. Christl also pointed out Jumpshot’s supply of data to Lotame, something the FTC also objected to. LiveRamp’s whole thing is resolving audiences based on personal information, though it says it will not return this information directly. Still, this granular identity resolution is not the kind of thing most people would like to participate in. Even if they consent, it is unclear if they are fully aware of the consequences.

This is just one settlement but it helps illustrate the distribution and mingling of granular user data. Marketers may be restricted to larger audiences and it may not be possible to directly extract users’ personally identifiable information — though it is often trivial to do so. But it is not comforting to be told collected data is only useful as part of a broader set. First of all, it is not: there are existing albeit limited ways it is possible to target small numbers of people. Even if that were true, though, this highly specific data is the foundation of larger sets. Ad tech companies want to follow you as specifically and closely as they can, and there are only nominal safeguards because collecting it all is too damn valuable.

  1. Well, and also how weird it is to be totally okay with collecting a massive amount of data with virtually no oversight or regulations so long as industry players pinky promise to only use some of it. ↥︎

Vice Is Dead ⇥ wsj.com

Alexander Saeedy and Alexandra Bruell, Wall Street Journal:

Vice Media said it would stop publishing content on its flagship website and plans to cut hundreds of jobs, following a failed effort by owner Fortress Investment Group to sell the embattled digital publisher and its brands.

From the internal memo sent by Bruce Dixon, Vice CEO:

We create and produce outstanding original content true to the Vice brand. However, it is no longer cost-effective for us to distribute our digital content the way we have done previously. Moving forward, we will look to partner with established media companies to distribute our digital content, including news, on their global platforms, as we fully transition to a studio model. As part of this shift, we will no longer publish content on vice.com, instead putting more emphasis on our social channels as we accelerate our discussions with partners to take our content to where it will be viewed most broadly.

The way Vice has “distributed [its] digital content […] previously” is by having a website. That it is not “cost-effective” to run a website is creating rumours that it is about to be shuttered without any real effort at preservation.

This is a real shame; Vice had some of the best privacy and security coverage in the industry. I am sure I have referenced the site’s work at least dozens of times. Its record is imperfect, especially recently, but it has published solid, creative reporting for decades. Four of its former writers founded 404 Media last year, and other have found new gigs. Still, if all these articles disappear from everywhere but the Internet Archive, it will be a deep loss.

Lawsuit Alleges Wrongly Accused Person Landed in Jail Thanks to Facial Recognition False Positive, Then Assaulted ⇥ vice.com

Matthew Gault, Vice:

In January of 2022, Harvey Murphy was arrested and thrown in jail while trying to get his driver’s license renewed at a local DMV. According to a $10 million lawsuit Murphy has since filed, a “loss prevention” agent working for a Sunglass Hut retail store used facial recognition software to accuse Murphy of perpetrating an armed robbery at a store in Houston, Texas. In reality, Murphy was more than 2,000 miles away at the time of the robbery.

According to a lawsuit 61-year-old Murphy has filed against Macy’s and Sunglass Hut, “he was arrested and put into an overcrowded maximum-security jail with violent criminals. While in jail trying to prove his innocence, he was beaten, gang-raped, and left with permanent and awful life-long injuries. Hours after being beaten and gang-raped, the charges against him were dropped and he was released.”

Via Tim Cushing, Techdirt:

Law enforcement loves to portray detentions that only last “hours” to be so minimally detrimental to people’s rights as to not be worth of additional attention, much less the focus of a civil rights lawsuit. But it only takes seconds to violate a right. And once it’s violated, it stays violated, even if charges are eventually dropped.

As usual, nobody is posting the original text of the lawsuit, so I pulled a copy myself.

What happened to Murphy is obviously the product of several failures at a human level. However, it is hard for me to believe any of this would have materialized without a false positive facial recognition which, allegedly, was conducted by EssilorLuxottica and Macy’s, not law enforcement. Even for the regulation reluctant, this must be one area where much stricter oversight and policies are enforced.

Update: I adjusted the headline for clarity.

Lina Khan’s FTC Gets Results Against Data Broker X-Mode ⇥ ftc.gov

In 2020, Joseph Cox of Vice published an investigation into HYAS, explaining how it received precise location data from X-Mode; I linked to this story at the time. The latter company, now Outlogic, obtained that data from, according to Cox’s reporting, an SDK embedded “in over 400 apps [which] gathers information on 60 million global monthly users on average”. It sold access to that data to marketers, law enforcement, and intelligence firms. Months later, Apple and Google said apps in their stores would be prohibited from embedding X-Mode’s SDK.

Even in the famously permissive privacy environment of the United States, it turns out some aspects of the company’s behaviour could be illegal and, in 2022, the FTC filed a complaint (PDF) alleging seven counts of “unfair and deceptive” trade. Today, the Commission has announced a settlement.

Lesley Fair of the FTC:

[…] Among other things, the proposed order puts substantial limits on sharing certain sensitive location data and requires the company to develop a comprehensive sensitive location data program to prevent the use and sale of consumers’ sensitive location data. X-Mode/Outlogic also must take steps to prevent clients from associating consumers with locations that provide services to LGBTQ+ individuals or with locations of public gatherings like marches or protests. In addition, the company must take effective steps to see to it that clients don’t use their location data to determine the identity or location of a specific individual’s home. And even for location data that may not reveal visits to sensitive locations, X-Mode/Outlogic must ensure consumers provide informed consent before it uses that data. Finally, X-Mode/Outlogic must delete or render non-sensitive the historical data it collected from its own apps or SDK and must tell its customers about the FTC’s requirement that such data should be deleted or rendered non-sensitive.

This all sounds good — it really does — but a closer reading of the reasoning behind the consent order (PDF) leaves a lot to be desired. Here are the seven counts from the original complaint (linked above) as described by the section title for each:

  • “X-Mode’s location data could be used to identify people and track them to sensitive locations”

  • “X-Mode failed to honour consumers’ privacy choices”

  • “X-Mode failed to notify users of its own apps of the purposes for which their location data would be used”

  • “X-Mode has provided app publishers with deceptive consumer disclosures”

  • “X-Mode fails to verify that third-party apps notified consumers of the purposes for which their location data would be used”

  • “X-Mode has targeted consumers based on sensitive characteristics”

  • “X-Mode’s business practices cause or are likely to cause substantial injury to consumers”

These are not entirely objections to X-Mode’s sale of location data in a gross violation of their privacy. These are mostly procedural violations, which you can see more clearly in the analysis of the proposed order (PDF). The first and fifth counts are both violations of the rights of protected classes; the second is an allegation of data collection after users had opted out. But the other four are all related to providing insufficient notice or consent, which is the kind of weak justification illustrating the boundaries of U.S. privacy law. Meaningful privacy regulation would not allow the exploitation of real-time location data even if a user had nominally agreed to it. Khan’s FTC is clearly working with the legal frameworks that are available, not the ones that are needed.

Sen. Ron Wyden’s office, which ran an investigation into X-Mode’s practices, is optimistic with reservations. Wyden correctly observes that this should not be decided on a case-by-case basis; everyone deserves a minimum standard of privacy. Though this post and case is U.S.-focused, that expectation is true worldwide, and we ought to pass much stricter privacy laws here in Canada.

Why Are So Many Pedestrians Getting Killed in the United States?

Emily Badger, Ben Blatt, and Josh Katz, New York Times (via Clive Thompson):1

Sometime around 2009, American roads started to become deadlier for pedestrians, particularly at night. Fatalities have risen ever since, reversing the effects of decades of safety improvements. And it’s not clear why.

What’s even more perplexing: Nothing resembling this pattern has occurred in other comparably wealthy countries. In places like Canada and Australia, a much lower share of pedestrian fatalities occurs at night, and those fatalities — rarer in number — have generally been declining, not rising.

This is a fascinating article precisely because of this second quoted paragraph. It has become commonplace to blame increased pedestrian deaths on the growing presence of massive trucks and SUVs, but I am skeptical of that reasoning.

The Times article does not really get into this, but the Canadian and U.S. auto markets are pretty similar, with basically the same vehicles for sale, the same trend of trucks replacing cars, and the same overwhelming preference for vehicles with automatic transmissions instead of those with a clutch pedal. Canadians do drive less than Americans — an average of 15,366 kilometres per year compared to 21,687 kilometres per year in the U.S. — though the latest data I can find for Canada is from 2009. It is rather bizarre to me that the Times authors ignore such a close comparison after acknowledging one exists, and instead choose to treat U.S. data in isolation for much of the rest of the article.

We also seem to do the same selfish and shameful things when we drive, though this is where I get a little out of my wheelhouse. Here is what I can find: U.S. drivers get arrested more often for driving under the influence: around 312 times per 100,000 people.2 The rate in Canada is lower, at 228 per 100,000, but it is not like assholes do not drink and drive here. We also legalized marijuana nationally in 2018, but trying to reliably measure drug impairment is considerably more difficult, resulting in a controversial criminal code change.

Plenty of people also use their phones while driving. I question the reliability of these reports; the Times cites a report from Cambridge Mobile Telematics, a company which produces an “AI-driven platform” for safer driving that “gathers sensor data from millions of IoT devices — including smartphones, proprietary Tags, connected vehicles, dashcams, and third-party devices — and fuses them with contextual data to create a unified view of vehicle and driver behavior”. I have only a vague sense of what that means, and I am not sure I can trust its precise-sounding finding of 2 minutes and 11 seconds per hour of driving time in the U.S. compared to a U.K. average of just 44 seconds.

I cannot trust the self-reported data of surveys conducted by Travelers Insurance, but if it is even remotely close to accurate, it suggests one reason why there is such a divergence. In the United States, 57% of survey respondents admitted to using a handheld device while driving, compared to just 17% in Canada. There is a similar split in people who read texts or emails — 57% in the U.S. and 21% in Canada — and in phone calls: 80% in the U.S. compared to 48% in Canada. Again, I do not think it is worth reading too much into this or any distracted driving statistic because it is obviously hard to accurately measure what drivers do when they are alone behind the wheel.

National collision data may be more reliable. In the U.S., the NHTSA says (PDF) around 8% of fatal collisions in 2021 were “distraction-affected’. According to Transport Canada, distraction was a “contributing factor” in an estimated 19.7% of fatal collisions the same year. These seem to me that they are reporting the same thing but they are so different I am not sure they are comparable. I was going to remove this section because I do not know how to reconcile these numbers, but then I would be left with only that dumb self-reported Travelers survey.

As I noted, the above few paragraphs are out of my lane of expertise. Call this more of a working-it-out-in-public post than an authoritative perspective, because this specific divergence of the safety of pedestrians in Canada and the U.S. — on roads which, as discussed, are fairly similar — is something which has haunted me since I wrote about it in July. I kept seeing articles blaming increasing vehicle size for pedestrian deaths, and it made sense to me: the top of the hood of a stock Chevrolet Silverado is very nearly the same height as the roof of a Volkswagen Golf like the one we have. I am most often a pedestrian and cyclist, and it can be terrifying to cross in front of these massive trucks, even though I am fairly tall. I fully bought this premise in part because I do think trucks and SUVs should have a legislated maximum size, and that most people should really just buy a hatchback or station wagon. I have heard all the excuses for why people in Canada need to daily drive a large vehicle, and they all fall flat. Other countries have dry-wallers and plumbers and larger families and camping holidays, and they all get by without needing to go everywhere in an apartment building on alloy rims.

The proliferation of these massive cars makes life worse for everyone else on the road who does not have one. At night, the headlights of oncoming traffic are pointed at my eye line, which means my eyes compensate for that brightness level, making it impossible to see the dark road ahead. When I am entering an intersection with an SUV street-parked on either side on the perpendicular road, I cannot see oncoming traffic until I nearly pull into its path. When I drive down the narrow-for-Calgary streets in my area, it is an increasingly tight squeeze when most other cars are massive and their drivers often less confident.

But all of these issues are shared between Canada and the U.S. — and only one of those countries is seeing soaring pedestrian death rates. The Times says this is happening particularly often at night, but we also have night, and commuting, and Daylight Saving Time.

In related news, Apple still says its new and more immersive version of CarPlay will appear in vehicle announcements in “late 2023” which, if I am not mistaken, is approximately now. It still worries me that drivers will soon be surrounded by screens with more information, more open apps, and more to be distracted by. A driver does not need to simultaneously see, as Apple illustrates, the current weather, international clocks, a list of smart home devices, a calendar, and the current song while doing 72 kilometres (45 miles) per hour. They need to look at and around the road — not drunk, not high, not using their phone, and not speeding — and recognize the responsibility of guiding a multi-tonne automobile on roads alongside other people who may not be enrobed in metal.

I know this is a very boring public service announcement but, in fairness, I do not want to die on the grille of a Chevrolet. It is unfortunate that so much else is more exciting than driving, yet someone who is unable to focus cannot instead do their daily tasks in many Canadian and American cities using public transit.

  1. The passive voice of the Times headline irks me:

    Why Are So Many American Pedestrians Dying at Night?

    Pedestrians are not “dying”. They are actually being killed, and at an alarming rate. ↥︎

  2. The FBI reported 1,024,508 DUI arrests in 2019 in a country of 328,239,523 people. Then I did math. ↥︎

Days After Downplaying Data Breach, 23andMe Confirms Information Disclosure From About Half Its Users ⇥ techcrunch.com

Lorenzo Franceschi-Bicchierai, TechCrunch:

On Friday, genetic testing company 23andMe announced that hackers accessed the personal data of 0.1% of customers, or about 14,000 individuals. The company also said that by accessing those accounts, hackers were also able to access “a significant number of files containing profile information about other users’ ancestry.” But 23andMe would not say how many “other users” were impacted by the breach that the company initially disclosed in early October.

As it turns out, there were a lot of “other users” who were victims of this data breach: 6.9 million affected individuals in total.

The announcement Friday was made in a financial disclosure, and the company updated an old blog post a day after this TechCrunch article was published. According to 23andMe, the information disclosed by the “DNA Relatives” feature will at minimum include a display name derived from one’s (presumably real) name, recent site activity, and “predicted” relationship.

Jason Koebler, 404 Media:

Every few years, I write an article about how it is generally not a good idea to voluntarily give your immutable genetic code to a for-profit company (or any other genetic database, for that matter), and how it is an even worse deal to pay money to do so. It is also not wise or ethical to gift a 23andMe Saliva Collection Kit to your loved ones for Christmas, their birthday, or any other reason.

Give your family and friends the gift of not subjecting their genetics to businesses with a data breach record of, as of writing and I cannot stress this enough, half their customer base.

Update: A very important postscript, via Brian Sutorius. Matthew Cortland:

So what measures has 23andMe announced to mitigate the tremendous harm their negligence has caused? If you guessed, “updating their Terms of Service to force customers – including everyone who has used 23andMe since their first product became available in the United States in 2007 – into binding arbitration” you’d be correct. 23andMe is updating their TOS to strip victims of the company’s negligence of the right to seek justice in a court of law, instead forcing those harmed by 23andMe’s conduct into binding arbitration. […]

Notification of the updated Terms of Service was sent to 23andMe users one day before it disclosed the results of its investigation. If you are a user, there are specific steps you need to follow this month to opt out of binding arbitration. Read Cortland’s post in full for more information.

2023 in Elon Musk and Antisemitism ⇥ semafor.com

Recently, you may recall, Elon Musk amplified some antisemitic conspiracy theories on the social media platform he owns and, notably, is its most popular user, and that caused widespread outrage. Which conspiracy theory? Which backlash? Well, it depends on how far back you want to look — but you need not rewind the clock very much at all.

David Gilbert, Vice:

Musk was repeating an oft-repeated and widely debunked claim that [George] Soros is attempting to help facilitate the replacement of Western civilization with immigrant populations, a conspiracy known as the Great Replacement Theory.

[…]

Musk also responded to tweets spreading other Soros conspiracy theories, including false claims that Soros, a Holocaust survivor, helped roundup Jews for the Nazis, and claims that Soros is somehow linked to the Rothschilds, an entirely separate antisemitic conspiracy theory about Jewish bankers which the Soros’ conspiracies have largely replaced.

This was from six months ago. I think that qualifies as “recent”. If I were a major advertiser, I would still be hesitant to write cheques today to promote my products in the vicinity of posts like these and others far, far worse.

So that is May; in June, Musk decided to reply to an explicitly antisemitic tweet — an action which, due to Twitter’s design, would have pushed both the reply and the context of the original tweet into some number of users’ feeds.

Which brings us to September.

Judd Legum and Tesnim Zekeria, Popular Information:

Musk quickly lost interest in banning the ADL and began discussing suing the organization. In a series of posts, Musk said the ADL “has been trying to kill this platform by falsely accusing it & me of being anti-Semitic” and “almost succeeded.” He claimed that the ADL was “responsible for most of our revenue loss” and said he was considering suing them for $4 billion. In a subsequent post, he upped the figure to $22 billion.

“To clear our platform’s name on the matter of anti-Semitism, it looks like we have no choice but to file a defamation lawsuit against the Anti-Defamation League … oh the irony!,” Musk said.

The ADL, however, never accused Musk or X of being anti-Semitic. The group reported, correctly, that X was hosting anti-Semitic content and Musk had rolled back efforts to combat hate speech. And the ADL, exercising its First Amendment rights, encouraged advertisers to spend their money elsewhere unless and until Musk changed course. The notion that the ADL, a Jewish group, has the power to force corporations to bend to its will is rooted in anti-Semitic tropes about Jewish power over the business world.

Perhaps you feel like being charitable to Musk, for some reason, and would like to assume that he does not understand the tropes and innuendo with which he has engaged. That seems overly kind to me, and I am impressed you are more willing than I to give him the benefit of the doubt. But it sure seems like Musk took the condemnation of his tweets seriously, as he hosted Benjamin Netanyahu, the prime minister of Israel, in San Francisco in an attempt to smooth things over. How did that go?

Well, on November 15, Musk doubled down.

Lora Kolodny, CNBC:

Musk, who has never reserved his social media posts for business matters alone, drew attention to a tweet that said Jewish people “have been pushing the exact kind of dialectical hatred against whites that they claim to want people to stop using against them.”

Musk replied to that tweet in emphatic agreement, “You have said the actual truth.”

That, and several other things, is a likely explanation for why major advertisers decided to pause or stop spending on the platform. On Friday, Ryan Mac and Kate Conger of the New York Times reported that Twitter may miss up to $75 million in ad revenue this year as a result of these withdrawals; Twitter disputes that number. Some companies have also stopped posting.

Clearly, this is all getting out of hand for Musk. But his big dumb posting fingers have gotten him into trouble before, and he knows just what to do: an apology tour.

Jenna Moon, Semafor:

Elon Musk toured the site of the Oct. 7 massacre by Hamas in southern Israel on Monday, as the billionaire made a wartime visit to the nation amid allegations of antisemitism.

How long are the remaining advertisers on Musk’s platform going to keep propping it up? How many times do they need to see that he is openly broadcasting agreement with disturbing and deeply bigoted views? I selected just the stories with an antisemitic component, and only those from this year; Musk routinely dips his fingers into other extremist views in a way that can most kindly be compared to a crappy edgelord.

I will leave you with the story of what happened when Henry Ford bought the Dearborn Independent.

A Preventable Surge of Hyundai and Kia Thefts in the U.S. ⇥ vice.com

Aaron Gordon, writing at the remaining shell of Vice:

For the last three months, I’ve been trying to find an answer to a basic question at the heart of this theft wave: Why didn’t the U.S. follow Canada’s lead and mandate immobilizers, too? If it had, either around the same time as Canada or when it considered new regulations in the mid-2010s, the method of stealing Kias and Hyundais widely popularized in online videos would not be possible, as evidenced by the fact that no similar theft wave is occurring north of the border. (Canada is experiencing its own problems with auto thefts, as explained below, but the trend is tied to organized crime and not centered around Kias and Hyundais or engine immobilizers).

I appreciate Gordon looking into this more than I was able to when I wrote about it earlier this year. TikTok and other social media platforms are being scapegoated for not preventing the spread of the technique behind this wave of thefts when it could have been prevented in the first place by regulators and automakers.

Pants on Fire

Benedict Evans:

Whenever anyone proposes new rules or regulations, the people affected always have reasons why this is a terrible idea that will cause huge damage. This applies to bankers, doctors, farmers, lawyers, academics… and indeed software engineers. They always say ‘no’ and policy-makers can’t take that at face value: they discount it by some percentage, as a form of bargaining. But when people say ‘no’, they might actually mean one of three different things, and it’s important to understand the difference.

This is a good piece categorizing the three types of “no” by industries facing new policies as: an aversion to lawmakers telling them what to do, plausible negative consequences of regulation, and technical impossibilities. But Evans does not give nearly enough weight to how often big industry players and their representatives simply lie. They often claim the effects of new regulations will be of the second or third type when there is no evidence to support their claims.

Corporations lying to get their way is not news, of course. A common thread among the examples cited by Evans is that policies which actually do fall into the categories of causing unintended negative effects or being impossible to achieve are noted as such by truly independent experts.

In 2015, after Uber launched in Calgary, the city proposed reasonable and sensible rules, which Uber claimed were entirely “unworkable” for ride sharing as a genre. Many, including popular media outlets, concurred with Uber and begged the city to fold. But it compromised on only a single rule; everything else was passed, meaning that Uber drivers were subject to the same sorts of regulations as taxi drivers because they do the same job. And guess what? Uber has been happily operating in Calgary ever since.

Apple spent years opposing repair legislation on the basis that people would hurt themselves replacing batteries, and that any state which passed such laws would become a “mecca for bad actors”. That line of argument was echoed by some, only for Apple to now support such legislation — with caveats — despite using exactly the same type of battery it says is dangerous for people to swap themselves.

After multiple reports — including several stories by Reveal in 2019 and 2020 — of serious injuries at Amazon warehouses caused in part by its infamously rigorous quotas, and a general avoidance of workers’ rights, lawmakers in California proposed corrective legislation in early 2021. Lobbyists freaked out. In the interim, Reveal found itself smeared “on background” by Amazon’s public relations team, which tells “outright lies” according to multiple reporters. The legislation was signed into law anyway in 2021. It is certainly too early to know its long-term effects, but injury rates at Amazon facilities fell in 2022, though its rates remain double (PDF) the rate of the rest of the industry.

Evans:

I think the structural problem here, across all three kinds of ‘no’, is that this is pretty new to most of us. I often compare regulation of tech to regulation of cars – we do regulate cars, but it’s complicated and there are many different kinds of question. ‘Should cars have different emissions requirements?’ is a different kind of question to ‘does the tax code favour too much low-density development?’ and both questions are complicated. It’s a lot easier to want less congestion in cities than to achieve it, and it’s a lot easier to worry about toxic content on social media than to solve it, or even agree what ‘solve’ would mean.

But we all grew up with cars. We have a pretty good idea of how roads work, and what gearboxes are, even if we’ve never seen one, and if someone proposed that cars should not come with seats or headlights because that’s unfair competition for third-party suppliers, we could all see the problem. When policy-makers ask for secure encryption with a back door, we do not always see that this would like be telling Ford and GM to stop their cars from crashing, and to make them run on gasoline that doesn’t burn. Well yes, that would be nice, but how? They say ‘no’? Easy – just threaten them with a fine of 25% of global revenue and they’ll build it!

The comparison to regulating cars is apt, though bungled by Evans. In the earliest days, cars killed a lot of people — drivers, passengers, and others. Some manufacturers introduced features like seatbelts, but safety was not an effective sales pitch (PDF). The U.S. federal government responded by passing the National Traffic and Motor Vehicle Safety Act which mandated the installation of various safety features, and Ralph Nader published “Unsafe at Any Speed” the same year. Laws were passed to encourage use of seatbelts and discourage drunk driving, and the rate of death and serious injury has fallen even as the sales and use of automobiles have risen. These laws were disputed by automakers and the public but they worked well.

Ever since, most laws which govern cars have trended toward increasing their efficiency, decreasing their damage to the environment, and improving their safety. These laws have arguably not gone far enough. Because many of the pickup trucks and SUVs which are sold to suburban families who dodge potholes and puddles are very heavy, they are exempt from stricter U.S. fuel economy standards. And I would be filled with regret if I did not remind you of the extensive lobbying orchestrated by automakers over the past century-and-a-bit to make walking across a road a crime, reduce taxes on auto sales, and lots of other things.

Lawmakers should of course be attentive to instances where everyone who knows about a topic is telling them it is impossible to do in the way they are proposing. It is not possible to create encryption which ensures no criminals or rogue states are able to intrude but permits execution of a secret wiretap warrant.

But can you really blame lawmakers when regulations are disputed by industry representatives? It sure does not help when the press and public repeat the myths they have created. If industries want to be regulated more effectively, they need to start by being honest. The press can help by more carefully scrutinizing corporate claims; even conservative, business-focused publications should be able to see that simply opposing regulation by parroting public relations pap is a worthless use of their time and words.

Teslas’ Estimated Range Does Not Reflect Driving Conditions ⇥ reuters.com

Steve Stecklow and Norihiko Shirouzu, Reuters:

Tesla years ago began exaggerating its vehicles’ potential driving distance – by rigging their range-estimating software. The company decided about a decade ago, for marketing purposes, to write algorithms for its range meter that would show drivers “rosy” projections for the distance it could travel on a full battery, according to a person familiar with an early design of the software for its in-dash readouts.

[…]

Tesla supervisors told some virtual team members to steer customers away from bringing their cars into service whenever possible. One current Tesla “Virtual Service Advisor” described part of his job in his LinkedIn profile: “Divert customers who do not require in person service.”

Such advisors handled a variety of issues, including range complaints. But last summer, Tesla created the Las Vegas “Diversion Team” to handle only range cases, according to the people familiar with the matter.

[…]

Tesla also updated its phone app so that any customer who complained about range could no longer book service appointments, one of the sources said. Instead, they could request that someone from Tesla contact them. It often took several days before owners were contacted because of the large backlog of range complaints, the source said.

A large portion of this report conveys Tesla’s internal decision-making based on the word of a single source. I am a little surprised Reuters decided to publish it.

Scott Case, of Recurrent, which is a service that monitors electric vehicle batteries and provides information to current owners and buyers of used vehicles:

The reality is that the laws of physics apply to Tesla, too – Tesla is not much different than other automakers. When you need to heat and cool your car – and your battery – in hot and cold weather conditions, you can’t drive as far. That impact is substantially lessened when a car is equipped with a heat pump and advanced thermal management, which many newer Teslas (and other cars) are.

It’s also worth noting that it’s not like other manufacturers have perfected accurate range estimates either. Actual range varies according to all kinds of different factors, like speed, temperature or use of climate control. Every other automaker has a different approach to sharing those estimates, but it often tends to be closer to reality than Tesla’s approach.

All electric cars are affected by temperature because people turn on the heater or air conditioner. So, too, are cars with internal combustion engines — the Canadian government estimates fuel consumption is increased by up to 20% because of air conditioners.

But there are chemistry changes which are specific to electric vehicles, and the combined impact on range is notable. Recurrent’s data indicates the Chevrolet Bolt and Ford Mustang Mach-E both get around 65% of their EPA-estimated range in sub-freezing temperatures, while Tesla models get less than half their estimated range. Even at more temperate spring or autumn temperatures, Teslas only give around 60% of the range estimated by the EPA, while it is between 90% and a little over 100% for the Bolt and Mustang. What is unique about the Tesla models is how they consistently display a range of around 90% of the EPA sticker, no matter the conditions.

The Reuters report portrays the range estimate as deliberately misleading in the sense that it is intelligently giving drivers an optimistic number: it uses “algorithms for its range meter that […] show drivers ‘rosy’ projections”. But I think the reality is even worse — it is actually a very dumb estimate which is not adjusted based on any real-world factors. These cars are supposed to be so smart they nearly drive themselves, but they use a range calculation that is the definition of ‘ignorance is bliss’? Choosing to use this misleading estimate is obviously beneficial to Tesla because it is not affected by actual driving. Even in a best-case scenario, the data collected by Recurrent suggests a Tesla’s displayed range is not actually achievable.

Recurrent’s data also shows why so many electric cars seem to be overbuilt, and please forgive me for this slow-to-realize lightbulb moment. There are plenty of people for whom a car with a 100 kilometre range would be acceptable, and it would make electric cars more affordable.1 But if it gets closer to 50 or 60 kilometres on one charge for several months a year when it is brand new and at its best, that is a severe compromise in the ugly sprawling car-centric cities of Canada and the United States.

Reuters’ source also told the reporters that customers complaining about range problems would be denied an appointment for service. That makes sense: Tesla allegedly knew its range estimates were not a reflection of reality, so there really was nothing wrong with the cars themselves. But it is horrible for customer trust. Just two days ago, Tesla settled a class-action lawsuit which claimed the company would sign a contract for installing solar panels on customers’ homes, then argue their roofs had too many angular bits and increase the cost. This does not appear to be a company that prides itself on service or communication.

  1. Whether there is a buying market for these cars is another matter entirely. Most buyers of pickup trucks and SUVs do not need a large vehicle with those capabilities. But they are routinely the best-selling vehicles in Canada and the U.S. because people buy what they want, not what actually fits their life or their garage. ↥︎