News for hackers. Stuff that matters.
Re:Three Companies Impersonated Millions to Influence Intern... by Jupe on Sunday May 14, 2023 @12:07AM (#35935239)
> LCX and Lead ID were responsible for many of these fake comments, letters, and petition signatures. Across four advocacy campaigns in 2017 and 2018, LCX fabricated consumer responses used in approximately 900,000 public comments submitted to the Environmental Protection Agency (EPA) and the Bureau of Ocean Energy Management (BOEM) at the U.S. Department of the Interior. Similarly, in advocacy campaigns between 2017 and 2019, Lead ID fabricated more than half a million consumer responses. These campaigns targeted a variety of government agencies and officials at the federal and state levels.

Wow. Just wow. How can anyone at these companies be avoiding jail time?

And who hired them? Is there no money trail?

Re:Three Companies Impersonated Millions to Influence Intern... by fshbbdssbbgdd on Sunday May 14, 2023 @12:38AM (#35935354)
I’m curious if prosecutors could try someone for 900k counts of a crime.
Re:Three Companies Impersonated Millions to Influence Intern... by Fezzik on Sunday May 14, 2023 @12:45AM (#35935385)
I don’t believe there’s a limit to the number of charges in an indictment… I know I have seen 100+ count charging instruments (for credit card fraud).
Re:Three Companies Impersonated Millions to Influence Intern... by tootie on Sunday May 14, 2023 @12:45AM (#35935382)
I found this: https://www.nytimes.com/2021/05/06/technology/internet-provi...

Says a bunch of companies received millions in fines a few years ago and it names AT&T, Charter, Comcast and some lobbying group.

Re:Three Companies Impersonated Millions to Influence Intern... by OscarTheGrinch on Sunday May 14, 2023 @01:33AM (#35935574)
Imagine if your water pipe decided to only serve you water occasionally, and when it did threw some random bull-crap in there?

Who would vote for that system?

Re:Three Companies Impersonated Millions to Influence Intern... by MathMonkeyMan on Sunday May 14, 2023 @01:41AM (#35935609)
Imagine if your television only showed you ads and propaganda.
Re:Three Companies Impersonated Millions to Influence Intern... by firsttimebigboy on Sunday May 14, 2023 @02:37AM (#35935841)
I don't have to imagine that
Re:Three Companies Impersonated Millions to Influence Intern... by oefnak on Sunday May 14, 2023 @02:50AM (#35935908)
I assume that's what he meant.
Re:Three Companies Impersonated Millions to Influence Intern... by bluSCALE4 on Sunday May 14, 2023 @02:55AM (#35935934)
It works so well too. Was on a r/visible, a Verizon subsidiary and they claim unlimited but it's really 1TB or less otherwise they threaten you. The thing is there are laws in place that bar carriers from doing this and the guy pointing this out is downvoted to hell because everyone there are all corporate defenders. Blow my mind that the phone consumer market are so gullible. When Comcast was pulling this shit, people were pissed. Nowadays people are falling in line.
Re:Three Companies Impersonated Millions to Influence Intern... by Sai_ on Sunday May 14, 2023 @03:07AM (#35935991)
> defenders

I read your comment as “…corporate defrauders…” and it made just as much sense in context.

Re:Three Companies Impersonated Millions to Influence Intern... by tootie on Sunday May 14, 2023 @09:44AM (#35937912)
In reality we haven't seen the worst case at all. In fact, we have companies like cloudflare arguing that they are obligated as an infrastructure provider to serve neonazi websites.
Re:Three Companies Impersonated Millions to Influence Intern... by nine_k on Sunday May 14, 2023 @01:37AM (#35935592)
This is why, I think, the future is either putting your money (or at least provable identity) where your mouth is, or not being heard (e.g. because everyone will assume a petition without hard proofs of identity fake).

Yes, this is disenfranchising. But not being heard while some company pretends to speak for you is even more disenfranchising.

Re:Three Companies Impersonated Millions to Influence Intern... by demindiro on Sunday May 14, 2023 @01:57AM (#35935668)
>This is why, I think, the future is either putting your money (or at least provable identity) where your mouth is

That will become less effective as companies become increasingly centralized, with just a few having many, many brands.

Re:Three Companies Impersonated Millions to Influence Intern... by Thorrez on Sunday May 14, 2023 @02:43AM (#35935876)
Why would companies becoming more centralized make "putting your money where your mouth is" less effective?
Re:Three Companies Impersonated Millions to Influence Intern... by bluSCALE4 on Sunday May 14, 2023 @02:50AM (#35935905)
Because it can become hard to pick a different brand since there really aren't any choices at all: it's a monopoly.
Re:Three Companies Impersonated Millions to Influence Intern... by incone123 on Sunday May 14, 2023 @03:52AM (#35936187)
You seem to be addressing a related but separate matter, namely boycotting products to influence companies. The topic in hand is companies pretending to be large numbers of anonymous people. This is what would be prevented if submissions to public consultations were tied to real-world identities.
Re:Three Companies Impersonated Millions to Influence Intern... by martin-adams on Sunday May 14, 2023 @02:50AM (#35935907)
Because they will start to have a monopoly and consumer choice will be so little, that you can’t avoid them.
Re:Three Companies Impersonated Millions to Influence Intern... by Thorrez on Monday May 15, 2023 @01:14AM (#35944106)
I think this is a miscommunication. You interpret nine_k's phrase "putting your money where your mouth is" as meaning "buying only from companies you support", but I think nine_k actually meant "having public comments require payment".
Re:Three Companies Impersonated Millions to Influence Intern... by throw101010 on Sunday May 14, 2023 @04:11AM (#35936291)
Maybe this will come off as cynical, but aren't the customers of these 3 companies doing what you suggest here? "Putting their money where their mouth is", and since they have a lot of money their voice gets heard over the ones of individuals with no money. I don't think it's your goal.

So your second intuition about proof of identity is better, but the minute you invent a foolproof identity system and it gets widly used (by fiat or even voluntarily), you give a tremendous amount of power to the issuer/manager of it, as they basically hold the power of also removing/altering your public identity at their whims. You also make it harder and harder to remain anonymous and preserve your privacy, two things that might seem useless in a functional democracy, but unfortunately democracies are not perfect and they can turn into totalitarian systems where the wet dream of dictators is exactly this: having total control over every individual, especially the ones who would dare signing petitions against them.

This is by far not something humans have solved systemically, we have the technical solutions to build such systems, and governments tend to push to implement them, but as someone who cares about privacy/censorship resistance I do my best to build alternative, opt-in, systems to go around them.

Re:Three Companies Impersonated Millions to Influence Intern... by M95D on Sunday May 14, 2023 @04:45AM (#35936432)
No. Public/private keys can be under the control of the individual. You only need the public key to be signed by a trusted 3rd party. That only gives them the power to revoke it, but even the revoking can't cancel what you already signed while the key was valid.
Re:Three Companies Impersonated Millions to Influence Intern... by DougN7 on Sunday May 14, 2023 @07:05AM (#35937087)
Imagine your “trusted third party” is or becomes a dictator, who logs all signed keys. This doesn’t solve anything I’m afraid.
Re:Three Companies Impersonated Millions to Influence Intern... by williamcotton on Sunday May 14, 2023 @07:33AM (#35937200)
Imagine if the sun exploded tomorrow!
Re:Three Companies Impersonated Millions to Influence Intern... by 2OEH8eoCRo0 on Sunday May 14, 2023 @07:16AM (#35937136)
Stop trying to solve everything. These complex issues are never solved but we can improve and work on them.
Re:Three Companies Impersonated Millions to Influence Intern... by mauvehaus on Sunday May 14, 2023 @07:49AM (#35937282)
There's value to considering possible points of failure up front.

Think of the inertia that mag stripe only payment cards have in the USA, and think about how long it's taken to get chip cards rolled out. And then consider that we don't have the more secure chip and pin variant that Europe has, and (to the best of my knowledge) don't have any plans to go that route in the future.

A bad solution with broad penetration and huge network effects is one that can't easily be changed in the future. Let's do imagine some worst case scenarios and think about what it would involve to harden a system against them before rolling it out to everyone.

Re:Three Companies Impersonated Millions to Influence Intern... by hamilyon2 on Sunday May 14, 2023 @08:28AM (#35937470)
Sorry, but public-private key pair sais nothing about birth or death of individual. Which is an occurrence as common as you would guess. Being living person in some country is the relevant information, holding some cryptographic keys is not.
Re:Three Companies Impersonated Millions to Influence Intern... by williamcotton on Sunday May 14, 2023 @07:43AM (#35937255)
Anonymity, in the age of cryptography, is not going anywhere.

Between astroturfing, AIs, trolls, and foreign involvement, we are increasingly in need of a countering force. We are currently suffering under the tyranny of the anonymous!

It is astonishing that so many people are still swayed by such outdated cyberpunk ideologies! The arguments of the 1990s do not make sense given the realities of the 2020s.

Re:Three Companies Impersonated Millions to Influence Intern... by ArekDymalski on Sunday May 14, 2023 @09:33AM (#35937820)
Don't you think that security-guaranteed-by-strong-goverment model is outdated too? Governments all around the world seem to be incompetent to solve the emerging issues.
Re:Three Companies Impersonated Millions to Influence Intern... by throw101010 on Sunday May 14, 2023 @09:36AM (#35937846)
> we are increasingly in need of a countering force. We are currently suffering under the tyranny of the anonymous!

Are you? What happens if this "need" isn't filled? Just because you can't probe popular opinion with an open comment system, it doesn't mean it is a requirement for society to work. We have systems to vote that work and don't have these issues. Simple paper ballots work really well.

> It is astonishing that so many people are still swayed by such outdated cyberpunk ideologies

Private companies and governments have never collected as much data as they do now, mostly without real consent, and they are getting the means to exploit this data very efficiently now with AI. The cypherpunk ideology (cyberpunk is a fictional sci-fi genre, although it's kinda related with its themes) applies more than ever in this context, it actually predicted the situation we are living, so I can't agree with you when you claim it is "outdated". Individuals should value their ability to be anonymous if they intend to remain somewhat free, this is the "counter" to mass surveillance.

Re:Three Companies Impersonated Millions to Influence Intern... by williamcotton on Sunday May 14, 2023 @10:02AM (#35938071)
What happens if this need isn’t filled? Well, the focus of this article for one, more and more astroturfing and fraud. How about riling up another country’s voting public with lies? Various forms of harassment and bullying? And do you think AIs are going to make this better or worse? Should we ignore all of this because we’re worried about the outcome matching the plot of a Gibson or Stephenson story?

I can’t come up with a better argument than I’ve made in these two articles:

https://www.williamcotton.com/articles/the-tyranny-of-the-an...

https://www.williamcotton.com/articles/authentically-human-i...

They are both short reads.

Re:Three Companies Impersonated Millions to Influence Intern... by RunSet on Sunday May 14, 2023 @09:00AM (#35937621)
> our second intuition about proof of identity is better, but the minute you invent a foolproof identity system and it gets widly used (by fiat or even voluntarily), you give a tremendous amount of power to the issuer/manager of it, as they basically hold the power of also removing/altering your public identity at their whims.

A decentralized way to issue and authenticate private keys, so as to eliminate the trust requirement- not just transferring it to a certificate issuer- seems needful.

Not only could it help eliminate the manufacture of consensus in OP, such a technology would have broad implications for trust and might lend itself to anti-counterfeiting measures.

Although such a development would also amount to solving the problem of Byzantine consensus so I would feel most fortunate to see it happen in my lifetime.

Re:Three Companies Impersonated Millions to Influence Intern... by withinboredom on Sunday May 14, 2023 @04:15AM (#35936302)
> This is why, I think, the future is either putting your money (or at least provable identity) where your mouth is, or not being heard

Oh, I assume this will be run by companies. What is stopping them from impersonating you? Or impersonating you after you're dead? How can we trust these companies not to sell access to identities? Further, why not sell/rent your access to your own identity?

Re:Three Companies Impersonated Millions to Influence Intern... by nine_k on Sunday May 14, 2023 @07:30AM (#35937189)
It's a good technical question.

Partly it's audit: check some randomly chosen votes, look for anyone not remembering casting their vote.

Partly it could be cryptography: you keep a private key and sign your vote with it. Your public key is stored by a trusted centralized institution, or several (see GitHub and signed commits), so anyone can verify your vote, but nobody can fake it.

Re:Three Companies Impersonated Millions to Influence Intern... by mauvehaus on Sunday May 14, 2023 @07:52AM (#35937297)
Voting is anonymous to make it harder for someone to demand proof that you voted in accordance with their wishes.

I wouldn't want my employer, for instance, to be able to verify that I voted for their preferred candidate for state representative and take retaliatory actions against me if I didn't.

Re:Three Companies Impersonated Millions to Influence Intern... by nine_k on Sunday May 14, 2023 @08:19AM (#35937428)
I don't speak of general voting, like for President.

I mean voting for various petitions, etc, the stuff outlined in the article.

Better fraud protection during general elections would be great, too, but it's a different and more complex area.

Re:Three Companies Impersonated Millions to Influence Intern... by kevingadd on Sunday May 14, 2023 @05:01AM (#35936515)
What makes you think lobbyists and large corporations can't afford the fee to speak?
Re:Three Companies Impersonated Millions to Influence Intern... by nine_k on Sunday May 14, 2023 @05:29AM (#35936642)
It's mostly not the fee to speak, even though a mere $1 per vote could be too expensive for some petition-spamming efforts: 100k payments from the same account would trigger suspicion, and creating 100k legal payment accounts (paypal, google / apple / samsung pay, venmo, etc) just to pay $1 per vote may be onerous.

I mostly say about giving a ton of identifying info so that your vote can be reliably tracked back to you: not only email (with a one-time link to confirm the email works), but also a phone number, postal address, maybe even some government ID like SSN or driver license number. It removes any expectation of anonymity from the vote or signature, and this is by design. Fraud of the kind the article mentions would be easily detectable by a random check of 1-2% of the signatures (and more is suspicious patterns are noticed). As a side effect, it would make a vote or a signature a much more conscious, committed decision.

Re:Three Companies Impersonated Millions to Influence Intern... by lubujackson on Sunday May 14, 2023 @12:52PM (#35939319)
We don't need an ironclad identity system, we need stronger laws making individuals behind companies like this personally and criminally liable with harsh penalties. That is how scenarios like this can be avoided: destroy the cost/benefit ratio of pursuing it.

Yes, fraud can still happen. But if you fake 100,000 comments eventually you will be discovered and held responsible. What this would reduce is systemic fraud at scale.

Re:Three Companies Impersonated Millions to Influence Intern... by lockhouse on Sunday May 14, 2023 @01:38PM (#35939709)
Can you even function in modern society without a government issued photo ID? It’s required to drive, collect benefits, fly, purchase alcohol, purchase tobacco, or even purchase Sudafed. I just can’t fathom that there are any actual petitioners or voters that requiring photo ID would disenfranchise.
Re:Three Companies Impersonated Millions to Influence Intern... by kevviiinn on Sunday May 14, 2023 @03:27PM (#35940660)
I guess the homeless and poor don't matter
Re:Three Companies Impersonated Millions to Influence Intern... by lockhouse on Sunday May 14, 2023 @06:20PM (#35941864)
Is there a state where you can sign up for public assistance without proving your identity with government issued ID? I'm not aware of any.

I'm pretty sure the Venn diagram of people without access to government issued ID and legal, eligible voters is two distinct circles.

Re:Three Companies Impersonated Millions to Influence Intern... by kevviiinn on Sunday May 14, 2023 @07:24PM (#35942263)
I'm pretty sure all citizens are eligible voters?
Re:Three Companies Impersonated Millions to Influence Intern... by lockhouse on Sunday May 14, 2023 @07:37PM (#35942358)
I’m pretty sure all citizens are able to get government issued ID
Re:Three Companies Impersonated Millions to Influence Intern... by ClumsyPilot on Sunday May 14, 2023 @07:56PM (#35942492)
UK does not issue ID, but you have to have an ID to vote now :D 4D chess

They have a register of random documents issued by 3rd parties that they will accept as proof of ID.

Re:Three Companies Impersonated Millions to Influence Intern... by kevviiinn on Sunday May 14, 2023 @09:56PM (#35943090)
There are areas that you have to pay for ID which disenfranchises the voters who can't afford it
Re:Three Companies Impersonated Millions to Influence Intern... by lockhouse on Sunday May 14, 2023 @10:13PM (#35943167)
Where are these places where potential voters can't afford ID and how do they do any of the other things that typically require photo ID?

https://www.washingtonexaminer.com/24-things-that-require-a-...

Re:Three Companies Impersonated Millions to Influence Intern... by kevviiinn on Monday May 15, 2023 @07:51AM (#35946724)
>how do they do any of the other things that typically require photo ID?

When they are poor enough they either don't or have incredibly limited funds. I'm not sure what you don't understand about this

Re:Three Companies Impersonated Millions to Influence Intern... by lockhouse on Monday May 15, 2023 @09:50AM (#35948116)
I just have a really hard time believing there is a large group of individuals without ID when it is essentially mandatory for modern life as an adult. I also am having difficulty believing that the usually less than $25 fee for government issued ID is an obstacle to anyone.

Personally I think a verified voter ID should be both required (so as to prevent voter fraud) and provided freely to everyone.

Re:Three Companies Impersonated Millions to Influence Intern... by kevviiinn on Monday May 15, 2023 @10:28AM (#35948719)
All that means is that you have an incredibly limited perspective shaped by your personal experiences. I would urge you to talk to people who are living on the streets or who work one or more minimum wage jobs to raise a family
Re:Three Companies Impersonated Millions to Influence Intern... by webinvest on Sunday May 14, 2023 @09:13PM (#35942895)
How do you invent a system where the websites instituting the identity proof (KYC/ Know Your Customer) systems don’t just become honeypots for collecting the necessary data to impersonate the millions of people that used it?

Others have commented on your point about money already

Re:Three Companies Impersonated Millions to Influence Intern... by eega on Sunday May 14, 2023 @02:45AM (#35935884)
Not only no jail, but the fine is laughable as well …
Re:Three Companies Impersonated Millions to Influence Intern... by lmeyerov on Sunday May 14, 2023 @08:41AM (#35937528)
Yeah this, setting the price to $100k to guide core laws around $B businesses in a way to override public feedback is cheap
Re:Three Companies Impersonated Millions to Influence Intern... by frankharv on Sunday May 14, 2023 @10:32AM (#35938311)
Why is it that a STATE AG is pressing for money while US AG does nothing?

STATE AG used Federal IG investigation to extract money from these crooks.

Why didn't FBI raid these companies?

They raided a ex-Presidents private residence for papers.

Identity Theft x 1 Million counts

Re:Three Companies Impersonated Millions to Influence Intern... by grayhatter on Sunday May 14, 2023 @12:39PM (#35939221)
> Why didn't FBI raid these companies?

> They raided a ex-Presidents private residence for papers.

Because that's not really how the FBI works. Recovering classified material from someone not entitled to be in possession of it is totally different. You probably want to read more, you seem to be speaking only at a very surface level, probably more than just Facebook too.

That said, while your rational for why they should be raided by the FBI is insane. I'm with you on the underlying idea. It seems crazy to me too that no federal agency is seeking charges under 18 USC 1001. How'd they avoid that?

Re:Three Companies Impersonated Millions to Influence Intern... by morsch on Sunday May 14, 2023 @03:10AM (#35936004)
So we know they manipulated the net neutrality debate, but what are the EPA and the BOEM processes that they attacked?
Re:Three Companies Impersonated Millions to Influence Intern... by netzego on Sunday May 14, 2023 @03:25AM (#35936078)
That bit friendly fraud must stay profitable. Otherwise the enemy would do it for half the price! And besides, they just protected their jobs. That reasonable and everybody would have done this!!
Re:Three Companies Impersonated Millions to Influence Intern... by nunuvit on Sunday May 14, 2023 @06:09AM (#35936855)
> The primary funders included an industry trade group and three companies that are among the biggest players in the United States internet, phone, and cable market,

They know who hired them, but they don't say in the report.

> The OAG has not found evidence that the broadband companies or their lobbying firm had direct knowledge that the lead generators they had funded engaged in fraud. As a result, the OAG has not found that these parties violated New York law.

> Under federal law, it is illegal in some circumstances to lie to the government, to copy another person’s identity, and to interfere with government processes. In New York, it is a misdemeanor to impersonate another by website or electronic means with intent to obtain a benefit. These criminal statutes were not designed to deter the misuse of hundreds of thousands of individuals’ identities. Congress and state governments — including New York’s legislature — should amend impersonation laws to provide for substantial penalties when many individuals are impersonated before a government agency or official.

I'd like to see them punished as much as possible under existing laws. The US government maybe could do so with what they currently have. NY would need to find evidence that shows intent. Not sure about other states.

Re:Three Companies Impersonated Millions to Influence Intern... by eternalban on Sunday May 14, 2023 @07:26AM (#35937170)
> And who hired them? Is there no money trail?

This is the most galling aspect of that article - crickets on who paid them to do the deed. The comapnies named are obviously front company for hire. The clients are telecomms that require FCC licenses to operate. They should get their licenses revoked.

Re:Three Companies Impersonated Millions to Influence Intern... by skizm on Sunday May 14, 2023 @07:54AM (#35937310)
They hire ad / "lead" companies to collect emails of people who have clicked on an ad, or entered their email saying they support A, B, or C and give them permission to post a comment on their behalf. So in theory each comment has someone who gave the company permission to post a comment for them. BUT if you tell an ad company "hey here is $2 million, get us X number of emails" they're going to produce X emails even if there are not X amount of people. The actual fake profiles come from "publisher" websites that generate fake clicks or leads. Usually the ad or lead companies will have some sort of system to detect fake / spam responses... but $2 million is a decent incentive to maybe loosen their standards a bit.
Re:Three Companies Impersonated Millions to Influence Intern... by Bran_son on Sunday May 14, 2023 @10:47AM (#35938405)
> emails of people who have clicked on an ad, or entered their email saying they support A, B, or C and give them permission to post a comment on their behalf

Even supposing they did it this way, and people gave their informed consent (fat chance, but for the sake of the hypothetical), that's still fraud. Unless every single comment had a "written and submitted on behalf of X by firm Y" disclaimer, it's still misrepresenting the comments as coming directly from individuals.

Regardless of what fine print unwary consumers agreed to, the agencies being deceived didn't agree to any of it.