Link Log

Sanctioned Russian Bank VTB Sneaked an App Into the App Store ⇥ 9to5mac.com

Zac Hall, 9to5Mac:

But on Friday morning, a random productivity app called Cириус broke into the top three.

[…]

The reality seems to be that the app is a Russian banking app disguised as a Pomodoro timer. Activity on Telegram this week points to the app actually being a client for Russian financial institution VTB Bank.

The link on “VTB Bank” goes to Wikipedia instead of VTB’s website, where the first tab on the home page slider is currently advertising this app. (Update: It has since been removed.) It is barely disguised. In Russian media, the developer says there are other apps lined up to take the place of this one after it is inevitably removed. Apple and Google have repeatedly failed to catch apps violating U.S. sanctions.

Hall:

The app will almost certainly be pulled soon, but it’s always surprising that existing systems in place sometimes miss detecting apps disguised like this.

I suppose the App Store review process could always be worse, but it is no longer surprising that its team, too focused elsewhere, does not catch egregious rule-breakers.

Documents Show Social Media Companies Specifically Marketed to Schoolchildren ⇥ nytimes.com

Jennifer Valentino-DeVries, New York Times:

Again and again, the world’s leading social media companies have targeted students, even as complaints have mounted that they are hurting teenagers’ mental health and academic performance, according to a New York Times review of internal documents that lay bare for the first time these tactics to hook young users.

[…]

The companies’ push to keep children glued to their screens has overshadowed concerns from parents, teachers and even their own trust and safety teams about interfering with school, according to the documents and interviews with dozens of parents, teachers and former tech company employees.

I do not think it will be surprising to many readers that these companies had strategies to increase usage by children, even during school hours, but I do think it is notable to see it spelled out in these documents. The popularity of these apps is not organic or foretold; it is, at least to some extent, created. There is no reason why Meta would need Instagram “ambassadors” at schools (PDF) to “drive product adoption” if it were not trying to increase Instagram use among teenagers.

Valentino-DeVries:

Members of the company’s [Google’s] education department were often excited about products they thought could improve learning, such as affordable laptops and educational YouTube videos, according to court documents and interviews. They worked alongside product managers, however, who were focused on a different upside: increasing YouTube’s viewership.

YouTube is maybe the trickiest of all these platforms to govern within schools because it has no alternative. There is a vast library of genuinely educational and informative video on the site, and then there is the rest of YouTube. It therefore makes sense to allow its use among students and within schools. However, YouTube has also been honed for boosting engagement, something which affects all users. That is not to say we should have exactly the same standards for children and adults, but it highlights the difficulty of using a singular platform with general-market financial incentives in an educational setting.

Not-Yet-Enabled Code Added to Meta A.I. App for Glasses-Based Facial Recognition Feature ⇥ wired.com

Dhruv Mehrotra and Dell Cameron, Wired:

Meta has quietly embedded face-recognition technology for its smart glasses into an app downloaded to millions of phones, according to a WIRED analysis of the company’s software.

[…]

Three AI models powering NameTag have already been deployed from Meta’s servers and now reside on its customers’ phones, according to WIRED’s analysis, which was independently reproduced by outside experts. One model detects faces, one crops them, and a third encodes them into biometric data.

Facial recognition, as Mehrotra and Cameron repeatedly note, is not yet enabled. But according to an Electronic Frontier Foundation researcher who tried the existing code, it appears to be partly functional.

Meta communications troll Andy Stone is really mad about this story and, on X, even claimed the “feature doesn’t exist” (Xcancel). Last time I spilled water across my keyboard, I was just happy my laptop still worked properly, but it seems that in Meta’s case, it resulted in writing an entire facial recognition feature and pushed it to production. Incredible stuff.

The New York Times reported on Meta’s rollout strategy for the feature earlier this year (previously linked), while Ryan Mac, then at Buzzfeed News, wrote in 2021 that Andrew Bosworth said facial recognition in smart glasses was something the company was exploring. On X, Bosworth built upon Stone’s reply (Xcancel) to this article claiming it is “incredibly misleading” and “dishonest”, for no particular reason.

Some companies are irredeemably bad and rotten to the core. The sooner Meta runs out of money and closes up shop, the better the world will be.

See Also: Buchodi’s technical breakdown.

Office 2019 for Mac Goes Read-Only in July ⇥ tidbits.com

Adam Engst, TidBits:

If you are still using Microsoft Office 2019 for Mac, it will stop working fully on 13 July 2026. Word, Excel, PowerPoint, and Outlook will enter “reduced functionality mode” — a euphemism meaning you can view and print documents but cannot edit, save, or create new ones. Microsoft’s documentation doesn’t clarify what this means for Outlook users.

Why is this happening? A certificate expiration is forcing Office 2019 into read-only mode, though Microsoft acknowledges this only obliquely in the FAQ. Without a current certificate, the apps can’t confirm you have a legitimate license.

Engst compares Microsoft’s approach to Apple’s when it issued an update earlier this year for decade-old iPhones, with a new certificate that allows iMessage and FaceTime to keep functioning. While Apple’s approach is welcome, it is also a good reminder why this proprietary service should always be paired with support for open standards like SMS and RCS.

Michael Tsai:

[…] The customer did their part by paying; it was the company that chose to impose the activation model in order to weed out cheaters; shouldn’t it then own any problems that creates?

But it’s actually worse than that because even subscribing to Office 365 doesn’t fix the problem. You need a newer version of Office, which necessitates a newer version of macOS, which may necessitate getting a new Mac — all to fix what seems like an artificial problem.

My workday began with a notification from Teams that the desktop app will stop working on 20 July, as Microsoft says it is only compatible with the three most recent versions of MacOS. The oldest supported version, therefore, is MacOS Sonoma and, given Apple’s own support policy, that means only Macs released in the past eight years or so are supported. Even though many Macs from that era remain capable and fast, eight years is a long time, and Teams remains available through a web browser.

Also today, OneDrive automatically updated to a newer version, which is incompatible with the version of MacOS I am running. I received no warning until I tried launching it. Microsoft provides no support for this kind of problem for end users but, luckily, I had a Time Machine backup I could use. However, I realized OneDrive would probably automatically update and I would have to do all this all over again, and it contains no relevant preferences. So I needed to delete the related files in /Library/LaunchAgents and /Library/LaunchDaemons and then, thanks to a tip from Sébastien Marchal, block the updater domain in my /etc/hosts file.

The software Microsoft makes is often the kind of thing people are required to use for their job. We do not have a choice of whether to have it installed. It would be nice if Microsoft cared just a little bit more about the durability of what it ships.

Powerful A.I. Super PACs Duel Over U.S. Midterm Elections ⇥ nytimes.com

Theodore Schleifer, New York Times (gift link):

The bad blood between the super PACs comes as powerful Silicon Valley companies race to shape the future of A.I. regulation. The groups are two of the biggest spenders in this year’s midterm elections, laying out nearly $24 million and promising that over $100 million more is on the way.

Their financial duel is effectively a proxy war between two of the biggest A.I. companies, Anthropic and OpenAI. One super PAC, Public First, is allied with Anthropic, while the other, Leading the Future, is aligned with OpenAI.

If those names sound familiar to you, it could be because I covered this topic last month. Schleifer’s story is, of course, far more in-depth and better-sourced — and, as an outsider, it is a story that does not leave me feeling particularly confident in the A.I. policy prospects in the world’s most powerful country.

The amount of money A.I. companies have on hand is truly staggering. Of course all of them are spending tens of millions of dollars to influence the results of a midterm election, just like how Formula 1 teams, which used to be plastered in cryptocurrency ads, are now covered in logos for A.I. companies. It is only going to get worse.

OpenAI posted a response to its website claiming it has “not made donations to any super PACs”. This appears to be technically true, though not meaningfully so, as Leading the Future is funded by OpenAI co-founder Greg Brockman and its founding was encouraged by OpenAI’s chief global affairs officer. OpenAI says “any engagement with that organization has been in a personal capacity, not on behalf of the company”, but the distinction between personal and business involvement seems wafer-thin when it comes to executives and super PACs reflecting the interests of the company they run.

The Meta A.I.-Powered Instagram Account Takeover Problem Gets Worse ⇥ techcrunch.com

Lorenzo Franceschi-Bicchierai, TechCrunch:

The widespread hacking campaign that relied on simply asking Meta AI’s chatbot to take over a victim’s Instagram account appears to have continued even after the company said the issue had been resolved. Meanwhile, the company has been scrambling to secure the targeted accounts and alert victims.

It is not very often for there to be an update on a security incident where it is less severe than originally reported, and I cannot remember a time when Meta has ever been able to provide such welcome news. And it is not as though this is some obscure or difficult-to-use way to hijack an account. If Meta has communicated to users any steps they can take to reduce the likelihood of becoming a victim, I have not received it.

Bill Gates’s Carefully Manicured Image Is Cracking ⇥ wsj.com

Emily Glazer, Wall Street Journal:

His [Bill Gates’] carefully crafted image has been shattered as more details of Gates’s association with the late Jeffrey Epstein have spilled into public view, challenging prior efforts by the 70-year-old to downplay his relationship with the sex offender. In a February town hall with foundation employees, Gates owned up to two affairs with Russian women referenced in Epstein’s emails.

[…]

Two different polling teams — at the Gates Foundation, and his private office, Gates Ventures — for years have closely tracked opinions about Gates, including on favorability, trustworthiness and inspiration. A media analysis prepared for the Gates Foundation found that there had been a more than 40% increase in “critical news narratives” about Gates and the foundation since the Epstein files were released through February, according to internal documents reviewed by The Wall Street Journal. 

There are so many little details in this story that are worth your time, but my big takeaway — aside from the Epstein stuff — is the neurotic obsession with building image that, I imagine, is fairly common among public figures. I know this, of course; you probably do, too. But to see it spelled out in the way Glazer does is quite something.

Gates pays people to obsess over his public perception for him — to choose his clothes, to work with Netflix on documentary-style vehicles for him, and to massage his blog and social media accounts. There is something truly bizarre about having a team edit together a video of a rich businessman going for pizza in an attempt to make him relatable and likeable, and then — presumably — tracking the performance of that Instagram post.

Gates and his foundation have done undeniable good in the world, while also being a figurehead of the mixed results of billionaire philanthropy. Also, he spent a lot of time around Epstein. It remains a mystery to me why billionaires like him also want to become beloved celebrity intellectual figures.

Meta A.I. Support Bot Meets Robert Hackerman, the County Password Inspector ⇥ krebsonsecurity.com

Brian Krebs:

A video released on Telegram by pro-Iran hackers claimed to document a remarkably simple exploit that appears to have involved using a VPN connection with an IP address that is in or near the target’s usual hometown, requesting a password reset for the account, and then choosing to chat with Meta’s AI support assistant. From there, the video shows the attacker told the bot to link the account in question to a new email address, after which the bot dutifully sent that address a one-time code that allowed a password reset.

Meta, a trillion-dollar corporation, should probably hire a few more people who have read the SMBC comic.

Meta Legal Action Forces Sarah Wynn-Williams to Sit Onstage in Silence ⇥ theguardian.com

Emma Loffhagen, the Guardian:

[Sarah] Wynn-Williams, whose bestselling memoir, Careless People, details her years working at Facebook, was due to appear in conversation with the investigative journalist Carole Cadwalladr and academic Tim Wu.

Instead, Wynn-Williams sat on stage for the duration of the hour-long discussion between Cadwalladr and Wu, without speaking or responding. She was unable even to nod or shake her head.

To be sure, Wynn-Williams’ silent appearance onstage is the kind of thing that would encourage press coverage and, presumably, this publicity could encourage book sales. Yet Meta has, for a full year now, insisted that “Careless People” is just a bunch of old anecdotes; pay no mind, there is nothing to see here. But its lawyers are vigorously enforcing the arbitration order (PDF) preventing her from making public remarks about Meta that could be construed as critical or negative.

I am no media relations expert, but I bet “Careless People” would feel much less potent if Meta realized it is a trillion-dollar corporation with a crappy reputation regardless of one ex-employee’s book, and with shareholders who do not care about what she wrote so long as the ads keep selling.

The Effects of Another Ad in iOS App Store Search ⇥ blog.thinktapwork.com

Jeremy Provost of development firm Think Tap Work:

It’s been 64 days since we first noticed Apple’s second ad position in search results for iPhone and iPad. Our update after two weeks showed consistently less search ad impressions for our apps, unless we invested heavily in paying for Search Ads.

Here are some updated numbers. Just like last time, these numbers only include App Store Search impressions from iOS devices. As you’ll see, these numbers get harder and harder to compare over time.

Chris Lindsay, developer of Nihongo, a Japanese dictionary app:

Before the rollout, my organic and paid downloads had remained pretty steady for most of the last year. After the rollout, my my organic installs dropped, and my paid installs rose. My overall downloads actually stayed roughly flat, but a large chunk of what used to be organic downloads appears to have shifted into paid downloads instead:

The ads themselves still work well. The problem is that many of these paid downloads seem to be users I previously would have acquired organically.

These ads are effectively another surcharge Apple has foisted upon developers for the privilege of distributing software to my iPhone and yours. Far from being premium “curated” experience, the App Store is this way because Apple has every incentive to steadily make it a little bit worse for users and developers — because where else are you going to go for your iPhone apps?

Checking in on Some Pro-Hate-Speech Social Networks ⇥ bnnbloomberg.ca

The Agence France-Presse reporting on the U.S. president’s social-media-and-cryptocurrency-and-maybe-nuclear-fusion operation:

Trump Media & Technology Group (TMTG) reported revenue of less than US$1 million for the three months ending March 31, according to a company filing.

Under $4 million in annual revenue is less than how much Twitter was earning in 2009 — unadjusted for inflation — an amount Steven Levy described as “modest”.

Speaking of Twitter, let us check in on SpaceX which, after a series of totally normal business deals, now owns the company and is preparing to trade publicly. Mike Masnick, of Techdirt:

Remember, the plan was $26.4 billion [in Twitter/X revenue] by 2028. We’re more than halfway there. How’s it going? Well… when he combines xAI (grok) revenue with X revenue (so not even just breaking out X’s ad revenue)… we get… a total of $3.201 billion in 2025. So, just to put this in perspective… when he took over in 2022 he laid out a five year plan to take the company that had $4.5 billion in ad revenue the year before he bought it up to $12 billion in five years. Three years in and… it’s now somewhere pretty far below $3 billion. […]

Earlier this year, a judge found against Elon Musk in a lawsuit filed by X against advertisers claiming they staged an illegal boycott.

The SpaceX prospectus, by the way, is one of the funniest documents to ever live on the sec.gov domain. It is lucky the business it is known for is so damn photogenic because it is, at present, a profitable satellite internet provider with side businesses of space exploration and artificial intelligence that each lose money. (How it internally accounts for the cost of sending Starlink satellites into orbit is a fantastic question.) And the present business model of the latter is something Patrick Boyle described as “renting GPUs to a competitor on terms that can vanish in a fiscal quarter”. Yet the company still claims the size of its total addressable market is over $28 trillion, or over one-fifth of the entire world’s GDP.

Even so, a $1.75–2 trillion valuation is plausible simply because of Musk. Similarly, and back to that AFP article:

According to its filing, TMTG generated US$900,000 in revenue during the first quarter, a paltry amount for a company valued at US$2.47 billion on the stock market.

That valuation is not much; at time of writing, it is worth about as much as Central Garden & Pet, owners of Nylabone and McKenzie plant seeds. That company last quarter posted revenues one thousand times greater than TMTG, with profit margins of over 12%. Nevertheless, TMTG has a connection to the U.S. president, so it is similarly valued. Lots of good, normal stuff happening in the world’s largest and most powerful economy.

Iris, a Photo History Explorer ⇥ irisphotos.app

Tyler Hall (finally) released Iris, and it is excellent:

And somewhere along the way the whole emotional center of the thing shifted. I set out to build an anti-Photos utility — a search engine for a hard drive. What I actually ended up with is a memory keeper. Open a photo today and Iris tells you the date, surfaces “16 items on this day,” drops a pin on the map, and lists the people in the frame with their ages quietly calculated from their birthdays. That is not a utility. That is the opposite of anti-anything.

I have been testing Iris for a couple of months and I think it is delightful. It reads all the photo libraries you point it at — your system library, whether that is in iCloud or local, and any folders you want like the one that contains your Lightroom edits, for example — and makes them accessible in a single, giant view.

But that is not the coolest part. No, that is that it lets you explore your tens- or hundreds-of-thousands of photos in a way that treats each of them as little memory boxes. So often, it is not just a picture of your kid, or your dog, or your dinner; it is a time you would like to remember. There are a bunch of things in each file that can bring you back to that moment. Photos does a poor job of that; Iris, on the other hand, is made for exactly that, something Hall takes seriously. How many apps are there with a manifesto?

Iris is great, old-school, indie Mac software.

Last.fm Announces It Has Gone Independent ⇥ support.last.fm

After nearly twenty years under CBS ownership, Last.fm is once again independent:

Your account, your listening history, and your data remain exactly where they are. The team building Last.fm is the same. The service continues as normal.

It is difficult to know whether it is riskier for Last.fm to be independent or under the banner of the hilariously corrupt Paramount Skydance conglomerate, but I imagine it would not — uh — last long if the leadership of the latter continues making cuts. I am happy to be a paying subscriber to a service I care about, and am excited to learn what comes next.

The Mythical App Store Reviewer Month ⇥ lapcatsoftware.com

Jeff Johnson:

I’d like to make an analogy between software development and Apple App Store review. A common, cursory reaction to the obvious failures of app review, the continual appearance of countless scams in the App Store, is to suggest that Apple hire more reviewers. My contention is that adding reviewers is not a solution to the problem of App Store curation, and the belief in such a solution is a myth. I don’t claim that hiring more reviewers would make app review slower. Rather, I think that meaningful, effective curation can’t be measured simply by the amount of available labor, much like [Fred] Brooks argues that the possibility of measuring useful work in units of time, man-months, is a myth.

Apple markets the App Store as a “curated storefront”, but that is not meaningfully true if it is serving up, as Apple says, about two million apps. Meanwhile, as Johnson writes, “nobody worries about scams in Apple Arcade […] a truly curated service”.

The thing is that Apple’s App Store should have a carefully selected inventory of apps. That is Apple’s whole brand: premium, highly-desirable products, and people are willing to pay a little more. The App Store does not match that promise. I think the direction of regulatory and court decisions on the governance of iOS app distribution could be a gift for more selective curation, the kind of thing for which some third-party developers would want to pay extra compared to the competing third-party app marketplaces that would also be available.

Alas, we are on the cusp of another WWDC during which Apple seems unlikely to make major changes to software distribution across its many “post-P.C.” platforms.

FTC Settles With Cox Media Group and Two Others Who Lied About Using Device Microphones to Collect Ad Targeting Data ⇥ ftc.gov

The U.S. Federal Trade Commission:

The Federal Trade Commission will require Cox Media Group (CMG) and two smaller marketing firms to pay a total of $930,000 to settle allegations they deceived customers by falsely claiming to offer an AI-powered service that could target localized ads based on conversations captured from consumers’ smart devices and that consumers had opted into such targeting.

Congratulations to Joseph Cox of 404 Media who broke this story in December 2023 and a related story about MindSift and 1010 Digital, the “smaller marketing firms” who settled with the FTC. According to the FTC’s complaint (PDF), Cox Media Group continued its fraudulent marketing through mid-2024, around the time the pitch deck was leaked to Cox. All three of these companies helped to feed the conspiracy theory that apps use device microphones to collect data for ad targeting.

For what it is worth, Cox Media Group told Reuters it “relied on marketing materials provided by a third-party vendor about the vendor’s product”.

Like many conspiracy theories, elements of this story were covered without skepticism by websites like the Daily Mail and Zero Hedge. These are crank websites that hinge on unreliable narration driven by confirmation bias; yet, both happen to be extremely popular, particularly among those who immerse themselves in conspiracy thinking. Because companies like Cox Media Group misrepresented how they collect information and took advantage of the relatively widespread suspicion that devices are listening to everything we say for ad targeting purposes, it undermines our ability to have a reasonable discussion about the actual ways in which they are ruining our privacy. From the FTC’s press release:

According to the complaints, this service did not, in fact, listen in on consumers’ conversations or use voice data at all — nor did the service accurately place ads in customers’ desired locations. Instead, the service the companies provided consisted of reselling — at a significant markup — email lists obtained from other data brokers.

Of course that is what Cox Media Group was doing. Not only does this settlement clarify this whole audio-based-ad-targeting narrative is nonsense, it also shows the power of the normalized yet still invasive practices of data brokers and ad tech. The damage done by Cox Media Group is that it is harder to have this conversation because they have poisoned the well. Meanwhile, anyone who is clinging to the conspiracy theory might point to this settlement as evidence of a cover-up — if crank websites cover this settlement at all. As of writing, I could not find it on either the Daily Mail or Zero Hedge.

Texas Attorney General Sues Meta, Claiming It Is Lying About WhatsApp’s End-to-End Encryption ⇥ arstechnica.com

Texas attorney general Ken Paxton:

Attorney General Ken Paxton filed suit against Meta Platforms Inc. and WhatsApp LLC (collectively “WhatsApp”) after the company misled consumers regarding the strength and scope of its privacy protections for its messaging app, WhatsApp.

Paxton is alleging (PDF) Meta is fully lying about the end-to-end encryption promise of WhatsApp in this wild lawsuit.

Dan Goodin, Ars Technica:

The sole factual evidence cited for the claims is an article published last month by Bloomberg. It reported that the US Commerce Department’s Bureau of Industry and Security [BIS] had abruptly closed an investigation into allegations that Meta could access encrypted WhatsApp messages shortly after one of the department’s agents sent an email outlining the probe’s preliminary findings.

[…]

Thursday’s lawsuit doesn’t indicate that the AG’s office has obtained the email itself or gathered any information from the investigators involved. Instead, it cites only the Bloomberg report for support. The complaint also noted that Meta employees receive plaintext WhatsApp messages that are reported to the company by fellow WhatsApp users. Those messages, however, are taken from the reporting party’s device only after they have been decrypted using the decryption keys available only to the reporting party.

More backdoor allegations were made in another lawsuit (PDF), this one filed in March, citing a January Bloomberg article that, in turn, says this was being investigated by the U.S. Department of Commerce and noting a 2024 SEC whistleblower report. There is no explanation in the lawsuit of how such a vulnerability could exist.

Earlier this year, before either Bloomberg article was published, a group of plaintiffs hired one of the most prestigious law firms in the United States to sue Meta with similar allegations, though they provided no technical evidence either. In later filings, the plaintiffs eventually cited the same April Bloomberg piece as Paxton. In response, Meta’s attorney submitted a forceful declaration (PDF) explaining that “the [Bloomberg] article itself included a statement from a BIS spokesperson explaining that the claims against WhatsApp were ‘unsubstantiated’ and BIS was not investigating WhatsApp or Meta”, and cited a number of external public articles questioning the technical merits of the case. The plaintiffs lawyer wrote in response (PDF) that “saying an investigation was not complete is very different than saying the facts are wrong” and, in turn, points to an article on Medium by Adrian Găitan. Găitan writes:

By the end of this article, you’ll understand not just that WhatsApp’s privacy model is broken — but exactly how it’s broken, layer by layer, from the cryptographic primitives all the way up to the FBI agent pulling your metadata every 15 minutes in near-real time.

This article feels compelling in its length, technical detail, and citation of declassified documents, but I found a closer reading conspicuously differs from what its introduction — and, indeed, these lawsuits — allege. Găitan points to eight distinct vulnerabilities. Two of them are extraction methods when data is at rest, like when it is stored in an iCloud or Google Drive backup, or bugs in the app that are exploited by a spyware vendor. This is not nothing, but it is also not a problem with end-to-end encryption; it is, in fact, a reminder of its limitations. Two others are irrelevant: Meta does not claim either A.I. prompts nor business chats are end-to-end encrypted.

That leaves four possible vulnerabilities Găitan alleges in WhatsApp’s specific security. One is the company’s willingness to install a “pen register” which provides to law enforcement a near-real-time record of user chat metadata, but not the contents of chats themselves. The second is the metadata WhatsApp stores and how it can be used to triangulate connections. Another complaint Găitan has is that WhatsApp is not open source, so it is not possible to fully verify Meta’s claims of secure end-to-end encryption. Lastly, Găitan points to research claiming it is possible for WhatsApp to surreptitiously modify the participants in a group chat.

For those keeping track, that leaves basically one vulnerability — the latter group chat problem — that would satisfy the kinds of claims being made in these lawsuits: that Meta has “unrestricted access to users’ communications”; that Meta and WhatsApp “have access to all WhatsApp users’ encrypted communications in their entirety”. One could make the case — and I certainly have — that backups of supposedly secure and private messaging platforms should be similarly inaccessible for meaningful “end-to-end encryption”. One could even make a reasonable argument that all of the issues raised in Găitan’s piece as all of them degrade WhatsApp’s privacy promise.

But these lawsuits are not making those claims. They are citing a single email from a government investigator as passed through a media report, and claims from whistleblowers and others that have not been validated. I am not stumping for WhatsApp here. If Meta has been lying about its privacy to the extent these lawsuits allege, it should face serious punishment. I suppose we will learn as they play out whether these claims have merit. It is, however, shocking to me how many lawsuits have been filed in such a short time period making essentially the same allegations yet without any actual proof.

‘How Deepfakes Tore a High School Apart’ ⇥ 404media.co

Samantha Cole, 404 Media:

On the morning of December 4, five ninth grade girls, all 14 or 15 years old, showed up for class at Radnor High School. By 8 a.m. — the sun had been up for less than an hour — it felt like the entire school already heard what happened the night before. A fellow freshman boy allegedly created AI-generated sexually explicit videos of the girls using an app, and sent them to his friends. From there, word of the videos and gossip spread from teenager to teenager, school to school, until they made their way back to the girls whose faces were in the deepfakes.

[…]

The images originated from one boy, who used an app called Movely, the girls and their parents believe. The app is similar to dozens hosted in the Apple and Google app stores and advertised on Instagram and TikTok that promise to create AI images and videos of users as superheroes, animals, or influencers; behind a paywall, however, users could edit photos and videos with text prompts.

It almost goes without saying, but the “paywall” is — or was; the app has been removed — an in-app payment from which Apple takes a 15–30% cut.

Apple released its annual justification for running software distribution through the App Store — it told European regulators it actually has five, so maybe this press release only concerns the one accessible from an iPhone — and there are some big numbers in it, as usual. Apple says it “took a number of actions to block bad actors from distributing malicious software, rejecting over 2 million problematic app submissions last year alone”. This Movely app was not one of them. It was only removed after the Tech Transparency Project reported in April that App Store search terms like “nudify” and “undress” displayed results for apps that do exactly that. In its press release, Apple says it has many features for directing kids to age-appropriate apps and restricting them from downloading those which are not but, of the software found by TTP in the App Store and Google Play Store, “31 of the apps were rated suitable for minors”.

Of Movely, the TTP said in its report:

Likewise, an App Store search for “adult AI” returned an ad for Movely – AI Photo to Video. The app offers a suite of AI photo and video editing tools including a try-on feature that will replace a woman’s clothes with outfits including bikinis and lingerie. One tool allows users to select part of any photo and edit it with a text prompt. To test this feature, TTP uploaded an image of a woman in a white T-shirt standing next to a river. After using the selection tool to highlight the woman’s shirt, we entered the prompt “topless.” The app immediately generated four versions of the woman nude from the waist up. It required a paid subscription to download the AI images.

TTP could not reach Movely’s developer, FES2 Inc., for comment. Emails sent to the developer bounced back as undeliverable.

(For clarity, the TTP says it used A.I.-generated images of women to test these apps.)

The search query used to find this app, “adult A.I.”, feels like something Apple should be testing against. If it does not want porn or porn-adjacent apps in its store, it should obviously block these kinds of keywords and flag the apps which are in the results. Moreover, Apple says:

As powerful AI development tools drive a surge in app submissions, Apple’s App Review process has seamlessly scaled to handle the volume and to help ensure every new app and app update meets the App Store’s high standards for privacy, security, and quality.

The Movely app should have raised flags here, too. The developer’s website was, according to the .co whois site, registered in July 2025, and is basically a placeholder. The app’s website was registered a week earlier, and the email address in the privacy policy does not match the one in the terms of service, nor does either match the developer’s website. Also, the blog is full of posts about generating A.I. girls and changing clothes.

These red flags are not obvious in hindsight; they should have been obvious from the time this app was submitted. Meanwhile, apps from longtime and trustworthy developers like Manton Reece and Radu Dutzan are stuck in App Review for dumb and basically invalid reasons.

Ontario Police Are Fighting to Keep Their Spyware Secret ⇥ thestar.com

Betsy Powell, the Star:

Essentially spyware, an ODIT [on‑device investigative tool] can grant almost unlimited access. Investigators can capture screenshots, monitor keypresses, access emails and text messages — including those that are encrypted — and even remotely activate microphones and cameras. All without the owner knowing.

By August, police announced 23 arrests, 279 charges, and more than $9 million in recovered vehicles.

But the case has also done something else: It has pulled back the curtain on how police forces in Ontario — not just in Windsor, but in Toronto and Peel Region — are now using these powerful technologies to reach deep inside suspects’ devices. And despite ODITs growing use in major prosecutions in the province, government lawyers and police are fighting tooth and nail to keep almost everything about them secret: how they work; what safeguards, if any, govern their use; even the names of the companies that sell them.

The details of this report align with research published last year by Citizen Lab about Paragon’s Graphite spyware, including a likely link to the Ontario Provincial Police. It is not the only police force in Canada using ODITs, either. In 2022, the RCMP acknowledged its own use; Christopher Parsons, a civil rights advocate and director at the Information and Privacy Commissioner of Ontario, keeps a small library of related policies.

Meta Secured Over $3 Billion in Tax Breaks in Louisiana to Build a Data Centre ⇥ sherwood.news

Jon Keegan, of Robinhood’s Sherwood News:

A Sherwood News analysis shows that the breaks afforded to Meta on just the sales tax of GPUs would come out to more than $3.3 billion — enough to build 33 new high schools, pay the salaries of all the state’s public school teachers for more than a year, or pay for more than seven years of the Louisiana State Police budget. (The secretary from the Parish committee that approved the financing plans declined to comment, and the chair of the committee didn’t respond to requests for comment.)

This is the very same project where Jonathan Weil, of the Wall Street Journal, found “aggressive accounting” that “strains credibility”. Neither of these advantages would be possible for a less-resourced competitor. Meta is a company so rich it benefits immensely without carrying nearly as much risk as the scale of this project would imply.

Bill C–22 Can Be Corrected ⇥ thestar.com

Justin Ling, the Star:

Yet Bill C-22 doesn’t mandate backdoors nor force companies to introduce any. It explicitly states the government cannot compel companies to introduce “systemic vulnerability” into their services. And it doesn’t give cops or spies new authority to intercept Canadians’ communications; it simply creates a process enlisting companies to help out with doing so.

Ottawa is now scrambling to correct the record. Anandasangaree will reply to the Republicans, conveying “this legislation does not provide for indiscriminate access to devices or communications and does not require companies to weaken encryption and introduce so-called ‘backdoors,’” according to a spokesperson. (The U.S. and the U.K., they also noted, already have these powers; Signal hasn’t withdrawn from either country.)

So the bill is not quite the nightmare some have made it out to be. But there are still some big issues.

Whether Signal is crying wolf or simply believes the laws in those countries are strong enough to prevent mandated backdoors is a good question. In the U.K., for instance, Ofcom is not allowed to require a backdoor, but it is empowered to tell providers to weaken encryption for some without compromising the privacy of their platforms for all when “feasible technology” exists to do so. On the one hand, that technology probably cannot exist; on the other hand, Signal is banking on a privacy-friendly interpretation of that law if it is ever tested.

Apple, meanwhile, has not returned Advanced Data Protection to the U.K. despite the U.S. Director of National Intelligence’s claim that efforts to compromise its encryption have been withdrawn. This demand was made under a different law that, I suppose, Signal must not feel is immediately threatening.

Bill C–22 does, as Ling writes, provide an exemption for instances where compliance with interception demands would “require the provider to introduce a systemic vulnerability related to that service or prevent the provider from rectifying such a vulnerability”. This is the same language as appeared in the Strong Borders Act proposed last year, though C–22 has new powers requiring the retention of metadata. It seems to me that a systemic vulnerability — one that “creates a substantial risk that secure information could be accessed by a person who does not have any right or authority to do so”, according to this bill — might not be found in something like metadata retention, which is what apparently concerns Signal.