Shirlley Coyle

On Monday evening, Starbucks sent a blatantly anti-union email to workers eligible to vote in union elections at three stores that begins on November 10.

“We want you to vote no,” the email addressed to workers at three unionizing stores in Buffalo, New York reads, “Unless you are positive you want to pay a Union to represent you to us, you must vote no. There is no opt out if the majority of voters vote yes, regardless of how you voted.”

If the Starbucks baristas vote to unionize, they would be the first workers at the vehemently anti-union coffee giant which operates more than 8,000 coffeeshops to do so, and could inspire others around the country to organize.

Last week, the National Labor Relations Board sided with workers, announcing that elections would be held at three separate stores beginning via mail-in ballots beginning on November 10 and ending on December 8. Starbucks wanted to open the voting up to stores across the entire Buffalo region, which would have given it the advantage in the election as some stores have not yet organized. The vote count will take place on December 9.

“There’s a lot going on,” the email continued. “We want to talk about and connect on the union vote and what it means and doesn’t mean for you, because it has a potentially big impact on your job and your store.”

This summer, Starbucks baristas under the banner Starbucks Workers United filed for union elections at three stores in Buffalo, citing erratic schedules, understaffing, and issues taking sick days. In turn, Starbucks—which has has often touted progressive values—launched a full-blown attack campaign, holding obligatory anti-union meetings, bringing in Rosann Williams, the president of Starbucks North America, and other executives to sweep the floors and do dishes, and giving workers wage increases and remedies for problems that workers have been complaining about for years (to demonstrate that a union, in the company's mind, isn't necessary).

Last week, Starbucks circulated a poster at one of the unionizing stores in Buffalo that said that it expected “infectious energy” from all workers and “all customers [to have] the best moment in  their day” at Starbucks. Meanwhile, unionizing workers at the Buffalo stores say workers have been overextended for months while they’ve been expected to risk their health and safety at work.

In September, the company temporarily closed one of the unionizing stores for training purposes, but after Motherboard covered the store closure, Starbucks reopened the store within days.

On Wednesday, crypto lending service C.R.E.A.M. Finance was the target of a hack that stole over $130 million. It’s not only one of the largest heists ever targeting a so-called “decentralized finance” (DeFi) platform, but also the third such hack targeting C.R.E.A.M., demonstrating the risks inherent in the burgeoning crypto loan industry.

C.R.E.A.M. was targeted by what is known as a flash loan attack. Flash loans are uncollateralized cryptocurrency loans structured so that they must be paid back instantly using smart contracts, making them attractive for things like arbitrage across exchanges. If the loan isn’t paid back, then it never happens, because both occur in the same transaction. 

Analysts on social media who pored over the details of the attack suggested that the hacker exploited C.R.E.A.M. in an incredibly complex transaction for a flash loan that ultimately allowed the hacker to drain C.R.E.A.M.’s Ethereum-based lending pools, leading to a gain of around $130 million in different tokens. The attack cost the hacker roughly 9 ETH in network fees, or around $36,000. 

The attacker left a bizarre message in the transaction text: "gÃTµ Baave lucky, iron bank lucky, cream not. ydev : incest bad, dont do." Aave is a competing crypto lending platform, while Iron Bank is a protocol-to-protocol lending service founded by C.R.E.A.M., which also refers to it as C.R.E.A.M. v2. According to C.R.E.A.M, its v1 lending service was targeted. In a tweet thread on Wednesday, the platform claimed that the vulnerabilities that allowed the hack to take place have since been patched. 

“We apologize to our users and community for this unfortunate incident and thank you for your support,” C.R.E.A.M. tweeted. 

The platform has fallen victim to hacks in the past. In August, $18.8 million was stolen from C.R.E.A.M  in a flash loan attack, The Block noted, and even earlier, in February, $37.5 million was stolen through C.R.E.A.M. via similar means.

The C.R.E.A.M. hack demonstrates the acute risks that come with crypto lending, which is an emerging industry encompassing billions of dollars in value. The basic idea is similar to a savings account with a bank, where you deposit money that the bank then lends out to clients and gives you interest. Similarly, C.R.E.A.M. and other services allow users to put their crypto into a pool to be lent out by the platform in return for interest, usually much larger than what a bank offers. Importantly, while funds you put into a bank are federally insured, funds you put into a crypto platform are not. 

Crypto loan services have come under fire from regulators in the U.S. recently. This year, regulators in three different states ordered BlockFi to shut down because it was offering unregistered securities, officials said. Major U.S.-based crypto exchange Coinbase also planned a loan offering but scrapped it after the Securities and Exchange Commission threatened to sue the company if it introduced the product. 

Over the past year, C.R.E.A.M., which stands for “Crypto Rules Everything Around Me” in an homage to Wu-Tang Clan’s classic track, has tried to mainstream its offerings. It even posted a theme song it said featured Method Man, who pops up at the start of the video bellowing "Ayo this is Method Man and this is not financial advice."

C.R.E.A.M Finance did not respond to Motherboard’s request for comment.

A 1,000-year-old gold burial mask excavated in Peru is covered with paint containing human blood, according to new research.

In the 1990s, archaeologists uncovered an ancient and mysterious burial ritual in Peru: in the center of the chamber was a man, seated with his upside-down skeleton painted red along with the gold mask that adorned his detached skull. Scientists initially attributed the paint's red pigment to cinnabar, but a new analysis has revealed another key ingredient: human blood. 

The skeleton belonged to a 40-to-50 year old man who was an elite member of Sicán society, which predated the Incas and existed between the ninth and 14th centuries in Peru. Scientists from the University of Oxford and Southern Illinois University were curious as to what the Sicán people used as binder in the paint that kept it attached to the gold mask for a millennium. 

According to the study, published recently in the American Chemical Society's Journal of Proteome Research, the scientists took a small sample of the paint and initial analyses revealed the presence of proteins. After digging down to find out just what those proteins were, the team discovered that they were proteins from human blood as well as egg whites from an unspecified bird. 

The researchers say that this mix of paint including human blood may have had special significance to the Sicán people. In fact, it could be part of a plot by that society’s wealthy elite to paint themselves as essentially celestial deities.

In an email, study co-author Luciana da Costa Carvalho explained that fellow co-author and director of the Sicán Archaeology Project Izumi Shimada believes that the ancient culture thought that blood represented one’s life force. In addition, there are Spanish Colonial documents describing pre-Hispanic myths that said societal elites were totally different from commoners, and were born from stars or eggs.

“Those myths also speak of how these elites upon death transform into the mythical deities or powerful ancestors who should be worshipped,” Carvalho wrote. “It is quite likely that Sicán elites (as with elites in many other ancient cultures) promulgated a vision/myth that distinguished them from the rest of the society and thus legitimized their power, wealth, etc. Thus, we may think of the use of human blood as a binder is an extension of the religious dogma that the Sicán elite promulgated so that they could attain the transformation to become deified ancestors.” 

“We can only speculate but it does seem that privileged elites commonly seek to retain, if not amplify, their power, prestige and wealth,” Carvalho continued. “Izumi thinks that the use of human blood by the Sicáns suggests their desire for immortality.” 

Using the techniques from this study, the researchers can now investigate other funerary masks held in private and museum collections to find out if the use of cinnabar paint mixed with human blood was a practice that was really restricted to elites. If the team can extract genetic information from the blood, Carvalho said, they may even be able to determine the identity of the individuals whose blood ended up serving Sicán society’s elite even after death.  

On Tuesday, Hertz announced it is buying 100,000 Teslas as part of a massive push into electric vehicles. This is a smart move by Hertz, because renting electric vehicles, especially in the U.S., is currently very difficult. Not only might people want to rent EVs when traveling, but it’s also an easy, no-risk way to try an EV before buying one.

This was well-received by the stock market and by the general public, because it was an example of a company that was recently on its deathbed doing something forward looking..

Uber had the same idea. On Wednesday, the company announced it has a deal with Hertz that 50,000 of those Teslas will be available for Uber drivers to rent by 2023, part of an ongoing rent-to-Uber program that dates back to 2016. This makes the Tesla purchases even better for Hertz, since it has a built-in customer base for those rentals.

As Uber CEO Dara Khosrowshahi told CNN, the plan is for drivers to rent a Tesla, see how great it is, then buy one themselves: “This is an open doorway for our driver community to try it…If you've been in a Tesla, I have, once you try it, you want to buy it.”

Uber is trying to piggyback on the positive press here, casting the partnership as a key part of its pledge to drastically ramp up its drivers’ EV usage, itself a major part of the company’s plan to have all of its rides in “zero emission vehicles” by 2040. The press is often saying the Hertz deal is part of Uber’s push to electrify its "fleet," but there is no such thing as an “Uber fleet.” Its “fleet” is other people’s cars. So those people have to willingly, of their own volition and using their own money, switch to electric.

The problem for Uber is drivers don’t want to switch to electric cars for good reasons. Typically, they live in and around expensive cities without access to overnight charging and cannot afford pricey EVs. And thus far Uber is only offering piddling incentives like an extra $1 per ride if the rider agrees to pay a higher fee for a “green” vehicle. Uber’s predicament with electrification remains the same as its problem with its business model: It wants drivers to buy EVs but doesn’t want to pay them enough so they can afford them.

Targeting drivers who rent their vehicles for EV adoption embodies this predicament. The rental program is a logical starting place for Uber’s EV efforts, considering Uber owns none of its cars and has never owned any of its cars, so using someone else's cars is one of the only ways it can get drivers into EVs quickly. But, it is also a program specifically geared towards drivers who cannot afford their own car—"Need a car to earn with Uber?” as the listing page says—so it’s not clear how these people will suddenly go from not being able to afford any gas car to being able to afford a pricey electric car. Not by driving rentals for Uber, that’s for sure.

It’s not even clear renting a Tesla for Uber driving will make much economic sense. “Tesla rentals will start out at $334 a week,” Uber’s press release notes, “and fall to $299 or lower as the program gets underway.” $334 a week compares unfavorably to the $214 a week gas cars are available at through the same program.

But won’t the Uber drivers save on gas, you ask? Not much. These drivers are extremely unlikely to have a Level 2 at-home charger installed the most economical way to charge an EV, both because they do not own an EV and because many Uber drivers especially in the largest markets live in apartments. Even if an Uber driver does have a garage with an outlet, they will barely get any charge from plugging it in overnight from a standard wall outlet.   As a result, they’re going to be relying on fast chargers, which are often about the same price as filling a gas tank.

Uber drivers with Pro Gold, Platinum, and Diamond status can save “up to 25 percent” at EVGo chargers, while Uber Pro Blue drivers save “up to 15 percent.” (These statuses are linked to driver points, cancellation rates, and ratings.) Those discounts will help, but may not fully counterbalance the higher weekly rental price of a Tesla versus a gas car. And Uber drivers tend to be deeply skeptical of discount programs and incentives offered by Uber, because the company has a track record of altering the terms or pulling the programs entirely with no notice.

This trust gap, created by Uber’s own mismanagement and callousness for the workers who actually make the company money, is also its largest barrier to EV adoption and all the climate goals it has set for itself. Because the only way Uber can get drivers to switch to electric in the near future is through these types of incentive programs. If drivers don’t believe Uber will stick to them, then there’s not much Uber can do except go on CNN and talk about it.

The National Telecommunications and Information Administration (NTIA), a federal agency that advises the president on telecom issues, has sent a letter to the Copyright office detailing a list of exemptions it believes should be made to the Digital Millennium Copyright Act (DCMA). The exemptions are critical because they let people circumvent copyright projections on things like video game consoles, tractors, and smartphones so they can fix their own devices without breaking the law.

Section 1201 of the 1998 Digital Millennium Copyright Act has language in it that manufacturers have used to say that circumventing software locks that prevent repair is a copyright violation or hacking. Under the strict rules of DMCA, breaking the copyright protection on a device to fix it is a violation of the manufacturer’s copyright, but there are certain exemptions that have to be begged for every three years that allow for specific types of repair.

As part of that review, the NTIA makes recommendations to the Copyright office for rules changes and exemptions. This year’s 144 page report is unequivocal: “NTIA recommends expansion of the current exemption to include circumvention of [technical protection measures] (TPM) for the diagnosis, maintenance, and repair of all software-enabled devices, machines, and systems for lawful modification that is necessary for a repair or maintenance, and for modifications of software regarding the functionality of a device,” NTIA said. “NTIA also recommends that the Librarian specify that the exemption permits these activities to be carried out with the assistance of third parties.”

NTIA is advocating that the Copyright office allow hardware and software that prevents tampering with devices to be circumvented to make repairs. Even if the device owner is getting a third party to make the repair. That would mean an independent repair shop could jailbreak your iPhone, or your tractor, or your fridge if it needed to in order to fix it. It would also mean you fix your own video game console without technically breaking the law. In the past, exemptions have been worded in such a way that makes it difficult to understand exactly who is allowed to circumvent TPMs.

NTIA noted that TPMs have become so ubiquitous that device manufacturers are building a future where no one can do any kind of basic repair of their own stuff without violating the law. “TPMs such as passwords and encrypted, locked, and compressed firmware are used to control access to digital cameras, ‘smart’ litterboxes, printers, microcontroller debuggers, camera stabilizers, e-readers, robotic companions, and radios,” it said.

The federal telecom agency also called out the entire process by which people ask for specific exemptions to Section 1201 every three years. “The current approach, which exempts circumvention for repairs to specifically named devices, substantially burdens noninfringing users, who must seek new exemptions for each device as OEMs add capabilities that rely on software,” it said. “NTIA supports expansion of the repair exemption to allow circumvention of TPMs—by a device’s owner or an authorized third party—for the purpose of the diagnosis, maintenance, and repair of software-enabled devices, for lawful modification that is necessary for a repair or maintenance, and for modifications of software regarding the functionality of a device.”

Nathan Proctor, the head of USPIRG's Right to Repair Campaign, told Motherboard he’s hopeful for the future of the right-to-repair. "Right to Repair made serious gains in the latest review of section 1201. We are especially pleased to see that there will now be an exemption for the repair, maintenance and diagnosis of medical equipment,” he told Motherboard in an email. “Many independent service technicians are being sued because the manufacturers claimed that their repairs violated copyright, and this exemption is very helpful to clarifying that, no, repair shouldn't be punished as a copyright violation."

"We're glad the Register of Copyrights finally agreed that copyright law shouldn't keep you from fixing your stuff—regardless of what 'type' of device it is,” Kyle Wiens, the CEO of iFixit, told Motherboard in an email. “Unfortunately, the new rules still maintain some absurd limitations—like excluding commercial devices and non-infringing modification of software-enabled devices (like changing the settings on a software-enabled cat litter box).”

Wiens said there’s still a lot of work to do on with the exemptions, noting that some manufacturers use service contracts to deny the exemption carved out for industrial equipment. “If repair is non-infringing then manufacturers' monopoly-preserving service contracts shouldn't prevent the Office from granting an exemption,” he said.

According to the NTIA, the reason why it’s advocating for simplified rules and broad exemptions is that the pandemic forced everyone in the office into remote work situations where they were repeatedly confronted by the need to quickly and easily repair their own stuff.

“Participants in this rulemaking have noted the barriers faced by educators attempting to make use of motion pictures in virtual classrooms, researchers who require access to rare or fragile works undergoing preservation, and even individuals trying to save money by using third party ink cartridges when printing documents at home,” it said. “In order to maximize the relief to Americans attempting to engage in…noninfringing activities, NTIA urges the Copyright Office and the Librarian to adopt exemptions that fully address the adverse impacts of the prohibition against circumvention without introducing unnecessary restrictions on these users.”

Proctor said there’s still a long way to go. "While it's encouraging to see Right to Repair get more support, we shouldn't need to fight every three years to show that fixing things isn't a copyright crime,” He said. “Repair obviously has nothing to do with copyright. And while this progress is important as a proof of concept, it doesn't cover providing tools that bypass protection measures, so it's still illegal to provide such repair tools. It's time Congress fixed this unintended consequence of the DMCA. Repair is not a crime!"

Wiens agreed. "Without access to those tools, the exemptions are largely academic,” he said. “This is why Congress needs to step in an permanently exempt repair, and repair tools, from Section 1201. Copyright law should never stand in the way of repair. Until Congress finally fixes Section 1201 and grants a permanent right to repair, we’re going to be stuck on this ferris wheel with the Copyright Office every three years.”

A hacker is taking over Instagram accounts before forcing their owners to make hostage-style videos promoting the hacker's money-making scams to try and get their money back. But instead of giving victims their cash back, the hacker then uses those videos to convince further victims that their scams are legitimate investments, according to a victim who shared the video and other material with Motherboard.

“I invested $500 and got $10,000 back. It is real and legit,” Yeri Henfield, a victim of the scam said in a video he said he was told to make by the hackers.

Henfield told Motherboard “These people are the definition of sin. It makes me so sick thinking who else they scammed. My page is also a shrine to my girlfriend who passed away almost 6 years ago. The page is now a disgrace.”

The scam started when Henfield spoke to an old roommate on Instagram, he said. From there, Henfield then started speaking to an account called “jaineverything,” which was advertising the tantalizing deal of investing $500 in bitcoins and getting much more money in return. Henfield sent Motherboard screenshots of what he said was him sending hundreds of dollars of BTC to jaineverything’s address.

But Henfield started to notice something was wrong. He realized that someone else was in control of his old roommate’s account.

“By the time I figured out by asking him where we were roommates at it was a dead giveaway it was a scam,” Henfield said.

Henfield had already sent the money, so he asked for it back. The person said they would return the funds if Henfield made a video saying that the Bitcoin scam was legitimate. He filmed multiple videos until the person was satisfied, Hanfield said. The person then said they would send a confirmation text to make sure the money was being sent to the right person. Henfield provided them with the code he received over text.

“Unbeknownst to me it was my Instagram request to gain access and change password,” Henfield said. Now, the scammer had control of his Instagram account as well.

Do you know about any other scams on Instagram or other social media networks? We'd love to hear from you. Using a non-work phone or computer, you can contact Joseph Cox securely on Signal on +44 20 8133 5190, Wickr on josephcox, or email [email protected].

The scammer posted the video from Henfield’s account as a Story and messaged it to his friends, Henfield said. The hacker had rapidly gone from not only extracting money from Henfield, but trying to use his own Instagram account and connections to scam others.

The video “was only on there for about 24 hours. I don’t know why they took it down, maybe it wasn’t so convincing. People who knew me could tell I was in discomfort,” Henfield said. Friends reached out to check he was okay, and when those friends also confronted the hacker through Henfield’s hijacked account, the hacker blocked them, Henfield said.

It appears that the jaineverything account was also a hijacked account. Henfield showed Motherboard screenshots of and forwarded copies of emails between him and the email address linked to the jaineverything Instagram account.

“You see that was my account then I got hacked they did the same thing to me,” the person wrote. They did not respond to a request for comment from Motherboard.

A screenshot of one of the posts on Henfield's account. Image: Motherboard.

A Facebook company spokesperson said in a statement that “We know that losing access to your account can be a distressing experience. We have sophisticated measures in place to stop bad actors in their tracks before they gain access to accounts, as well as measures to help people recover their accounts. We know we can do more here, and we're working hard in both of these areas to stop bad actors before they cause harm, and to keep our community safe.”

Facebook said it looked into the accounts and disabled the jaineverything account. They said that Henfield should try logging back into this account as he would be presented with instructions on how to recover it. When asked what exactly looking into the accounts entailed, such as reviewing the IP addresses used to log into the accounts, Facebook said it uses a variety of signals, including the user reports themselves and spammy behavior.

At the time of writing, Henfield said he still does not have access to his hacked account. The most recent post is one related to the scam, posted by the hacker seemingly in the hopes of attracting others to send them money.

“God Bless you for helping me trade Bitcoin successfully,” it reads.

Subscribe to our cybersecurity podcast CYBER, here. Subscribe to our new Twitch channel.

On October 20, a man opened fire on people attempting to steal his cryptocurrency mining equipment in the Abkhazia region bordering Russia. According to police, the man killed one of his own friends while fending off the attackers and is now in custody.

Abkhazia is a disputed territory along the Black Sea where officials have been fighting cryptocurrency miners for years. Electricity in the country is ten times cheaper than in neighboring Georgia and miners have flooded the area and stressed the power grid, leading to rolling blackouts. The problem is so bad that Abkhazia has estimated there is one crypto-mining facility for every 400 residents. Abkhazia briefly legalized mining, but then outlawed it again this year and began to seize and destroy the machines.

Authorities in Abkhazia have just started the investigation of the cryptocurrency shooting but early reports indicated it was a robbery gone wrong. According to a statement from the General Prosecutor’s Office of Abkhazia, a group of men running a cryptocurrency mining operation in the village of Aatsy tried to stop the theft of their machines by at least five men using Kalashnikov rifles and Makarov pistols. Amid the gunfire, police say that one of the men killed his friend.

“When stopping the theft of equipment for the extraction of cryptocurrency by at least five persons, they opened fire from the available firearms, as a result of which Pachial R.G., realizing the social danger of his actions when firing shots from close range, comitted the murder of A.B. Ardzibna,” the statement said, according to Google translate.

According to Echo of the Caucasus, there are conflicting reports about what actually happened during the shooting. The official statement is worded strangely and friends and family of the deceased are keeping quiet so as not to disrupt the investigation, though the outlet notes that it appears indisputable that the shooting occurred around and because of a Bitcoin mine.

“Astamur Ardzinba was killed. A friend, a classmate of my eldest son. A well-mannered young man whom I loved in a fatherly way. I have been broken since yesterday,” Abkhazia blogger David Dasnia said on his Facebook page, Echo of the Caucasus reported. “I cry like a child from impotence. Only one thought comes to my mind: what about his father? May his murderers be cursed forever and ever! When will total order be restored in Abkhazia?”

New York’s Department of Environmental Conservation has denied permits to two proposed natural gas upgrades to existing power plants, citing concern about climate change and greenhouse gas emissions associated with the plants. 

The agency denied permits to a major expansion of the Danskammer Energy Center in Newburgh, New York, and upgrades to the Astoria Gas Turbine Power plant in Queens. In both cases, the agency “determined the proposed project does not demonstrate compliance with the requirements of the Climate Leadership and Community Protection Act," according to a statement.

"The proposed project would be inconsistent with or would interfere with the statewide greenhouse gas emissions limits established in the Climate Act. [The companies behind these projects] failed to demonstrate the need or justification for the proposed project notwithstanding this inconsistency," the agency said. 

The move shows that states like New York are getting serious about greening the grid, and aren’t willing to rubber-stamp fossil fuel plants if it comes at the expense of fighting climate change. It also follows months of activism by community members who spoke out at public meetings and filed thousands of comments opposing the power plants. 

The decisions cite the Climate Act, a law enacted on Jan. 1, 2020 that requires the state to push its greenhouse gas emissions to 40 percent below 1990 levels by 2030. According to the agency, the projects “would result in substantial direct greenhouse gas emissions” that would make it more difficult for the state to reach its climate goals.

“The Project is also inconsistent with other longer-term requirements of the Climate Act, given that it would be a new facility which would use fossil fuels to produce electricity,” the agency found. “To achieve the State’s climate change and clean energy policies as outlined in the CLCPA, the State needs to continue to accelerate its ongoing transition away from natural gas and other fossil fuels. Constructing and operating a new fossil fuel-fired power plant accomplishes the exact opposite and perpetuates a reliance on fossil fuels."