Up to 1,500 Businesses Affected by Ransomware Attack, US Firm’s CEO Says

Between 800 and 1,500 businesses around the world have been affected by a ransomware attack centered on U.S. information technology firm Kaseya, its chief executive said Monday. Fred Voccola, the Florida-based company’s CEO, said in an interview that it was hard to estimate the precise impact of Friday’s attack because those hit were mainly customers of Kaseya’s customers. Kaseya provides software tools to information technology outsourcing shops: companies that typically handle back-office work for companies too small or modestly resourced to have their own tech departments. One of those tools was subverted Friday, allowing the hackers to paralyze hundreds of businesses on five continents. Although most of those affected have been small concerns such as dentists’ offices or accountants, the disruption has been felt more keenly in Sweden, where hundreds of supermarkets had to close because their cash registers were inoperative, or New Zealand, where schools and kindergartens were knocked offline. FILE – A sign reads: “Temporarily Closed. We have an IT-disturbance and our systems are not functioning”, posted in the window of a closed Coop supermarket store in Stockholm, Sweden, July 3, 2021.The hackers who claimed responsibility for the breach have demanded $70 million to restore all the affected businesses’ data, although they have indicated a willingness to temper their demands in private conversations with a cybersecurity expert and with Reuters. “We are always ready to negotiate,” a representative of the hackers told Reuters earlier Monday. The representative, who spoke via a chat interface on the hackers’ website, didn’t provide their name. Voccola refused to say whether he was ready to take the hackers up on the offer. “I can’t comment yes, no or maybe,” he said when asked whether his company would talk to or pay the hackers. “No comment on anything to do with negotiating with terrorists in any way.” Voccola said he had spoken to officials at the White House, the FBI and the Department of Homeland Security about the breach, but so far, he was not aware of any nationally important business being affected. “We’re not looking at massive critical infrastructure,” he said. “That’s not our business. We’re not running AT&T’s network or Verizon’s 911 system. Nothing like that.” Because Voccola’s firm was in the process of fixing a vulnerability in the software that was exploited by the hackers when the ransomware attack was executed, some information security professionals have speculated that the hackers might’ve been monitoring his company’s communications from the inside. Voccola said neither he nor the investigators his company had brought in had seen any sign of that. “We don’t believe that they were in our network,” he said. He added that the details of the breach would be made public “once its ‘safe’ and OK to do that.” About a dozen different countries have been affected by the breach, according to research published by cybersecurity firm ESET.  

Asia Industry Group Warns Privacy Law Changes May Force Tech Firms to Quit Hong Kong

An Asian industry group that includes Google, Facebook and Twitter has warned that tech companies could stop offering their services in Hong Kong if the Chinese territory proceeds with plans to change privacy laws.
The warning came in a letter sent by the Asia Internet Coalition, of which all three companies, in addition to Apple Inc, LinkedIn and others, are members.
Proposed amendments to privacy laws in Hong Kong could see individuals hit with “severe sanctions”, said the June 25 letter to the territory’s privacy commissioner for personal data, Ada Chung Lai-ling, without specifying what the sanctions would be.
“Introducing sanctions aimed at individuals is not aligned with global norms and trends,” added the letter, whose contents were first reported by the Wall Street Journal.
“The only way to avoid these sanctions for technology companies would be to refrain from investing and offering their services in Hong Kong, thereby depriving Hong Kong businesses and consumers, whilst also creating new barriers to trade.”
In the six-page letter, AIC managing director Jeff Paine acknowledged the proposed amendments focus on the safety and personal data privacy of individuals. “However, we wish to stress that doxxing is a matter of serious concern,” he wrote.
During anti-government protests in Hong Kong in 2019, doxxing – or publicly releasing private or identifying information about an individual or organisation – came under scrutiny when police were targeted after their details were released online.
The details of some officers’ home addresses and children’s schools were also exposed by anti-government protesters, some of who threatened them and their families online.
“We … believe that any anti-doxxing legislation, which can have the effect of curtailing free expression, must be built upon principles of necessity and proportionality,” the AIC said.
Facebook did not immediately respond to a Reuters request for comment, while Twitter referred questions to the AIC.
Google declined to comment.
The former British colony of Hong Kong returned to Chinese rule in 1997 with the guarantee of continued freedoms. Pro-democracy activists say those freedoms are being whittled away by Beijing, especially with a national security law introduced last year cracking down on dissent. China denies the charge.
 

Holiday-Weekend Ransomware Attack Leaves Companies Scrambling

Businesses around the world rushed Saturday to contain a ransomware attack that has paralyzed their computer networks, a situation complicated in the U.S. by offices lightly staffed at the start of the Fourth of July holiday weekend. It’s not yet known how many organizations have been hit by demands that they pay a ransom in order to get their systems working again. But some cybersecurity researchers predict the attack targeting customers of software supplier Kaseya could be one of the broadest ransomware attacks on record.  It follows a scourge of headline-grabbing attacks over recent months that have been a source of diplomatic tension between U.S. President Joe Biden and Russian President Vladimir Putin over whether Russia has become a haven for cybercriminal gangs. Biden said Saturday he didn’t yet know for certain who was responsible but suggested that the U.S. would respond if Russia was found to have anything to do with it.  “If it is either with the knowledge of and or a consequence of Russia then I told Putin we will respond,” Biden said. “We’re not certain. The initial thinking was it was not the Russian government.” Cybersecurity experts say the REvil gang, a major Russian-speaking ransomware syndicate, appears to be behind the attack that targeted the software company Kaseya, using its network-management package as a conduit to spread the ransomware through cloud-service providers. “The number of victims here is already over 1,000 and will likely reach into the tens of thousands,” said cybersecurity expert Dmitri Alperovitch of the Silverado Policy Accelerator think tank. “No other ransomware campaign comes even close in terms of impact.” The cybersecurity firm ESET says there are victims in least 17 countries, including the United Kingdom, South Africa, Canada, Argentina, Mexico, Kenya and Germany. In Sweden, most of the grocery chain Coop’s 800 stores were unable to open because their cash registers weren’t working, according to SVT, the country’s public broadcaster. The Swedish State Railways and a major local pharmacy chain were also affected. Kaseya CEO Fred Voccola said in a statement that the company believes it has identified the source of the vulnerability and will “release that patch as quickly as possible to get our customers back up and running.” Voccola said fewer than 40 of Kaseya’s customers were known to be affected, but experts said the ransomware could still be affecting hundreds more companies that rely on Kaseya’s clients that provide broader IT services.John Hammond of the security firm Huntress Labs said he was aware of a number of managed-services providers — companies that host IT infrastructure for multiple customers — being hit by the ransomware, which encrypts networks until the victims pay off attackers. “It’s reasonable to think this could potentially be impacting thousands of small businesses,” said Hammond, basing his estimate on the service providers reaching out to his company for assistance and comments on Reddit showing how others are responding. At least some victims appeared to be getting ransoms set at $45,000, considered a small demand but one that could quickly add up when sought from thousands of victims, said Brett Callow, a ransomware expert at the cybersecurity firm Emsisoft. FILE – An “Out of Service” bag covers a gas pump as cars line up at a Circle K gas station near uptown Charlotte, North Carolina, May 11, 2021, after a ransomware attack shut the Colonial Pipeline, a major East Coast gasoline provider.Callow said it’s not uncommon for sophisticated ransomware gangs to perform an audit after stealing a victim’s financial records to see what they can really afford to pay, but that won’t be possible when there are so many victims to negotiate with. “They just pitched the demand amount at a level most companies will be willing to pay,” he said.  Voccola said the problem is only affecting its “on premise” customers, which means organizations running their own data centers. It’s not affecting its cloud-based services running software for customers, though Kaseya also shut down those servers as a precaution, he said. The company added in a statement Saturday that “customers who experienced ransomware and receive a communication from the attackers should not click on any links — they may be weaponized.” Gartner analyst Katell Thielemann said it’s clear that Kaseya quickly sprang to action, but it’s less clear whether their affected clients had the same level of preparedness. “They reacted with an abundance of caution,” she said. “But the reality of this event is it was architected for maximum impact, combining a supply chain attack with a ransomware attack.” Supply chain attacks are those that typically infiltrate widely used software and spread malware as it updates automatically. Complicating the response is that it happened at the start of a major holiday weekend in the U.S., when most corporate IT teams aren’t fully staffed. That could also leave those organizations unable to address other security vulnerabilities, such a dangerous Microsoft bug affecting software for print jobs, said James Shank, of threat intelligence firm Team Cymru. “Customers of Kaseya are in the worst possible situation,” he said. “They’re racing against time to get the updates out on other critical bugs.” The federal Cybersecurity and Infrastructure Security Agency said in a statement that it is closely monitoring the situation and working with the FBI to collect more information about its impact. CISA urged anyone who might be affected to “follow Kaseya’s guidance to shut down VSA servers immediately.” Kaseya runs what’s called a virtual system administrator, or VSA, that’s used to remotely manage and monitor a customer’s network. The privately held Kaseya is based in Dublin, Ireland, with a U.S. headquarters in Miami.  REvil, the group most experts have tied to the attack, was the same ransomware provider that the FBI linked to an attack on JBS SA, a major global meat processor that paid an $11 million ransom, amid the Memorial Day holiday weekend in May. Active since April 2019, the group provides ransomware as a service, meaning it develops the network-paralyzing software and leases it to so-called affiliates who infect targets and earn the lion’s share of ransoms. U.S. officials have said the most potent ransomware gangs are based in Russia and allied states and operate with Kremlin tolerance and sometimes collude with Russian security services.  Asked about the attack during a trip to Michigan on Saturday, Biden said he had asked the intelligence community for a “deep dive” on what happened. He said he expected to know more by Sunday. 

Major Swedish Supermarket Chain Hit by Cyberattack

One of Sweden’s biggest supermarket chains said Saturday it had to temporarily close around 800 stores nationwide after a cyberattack blocked access to its checkouts.”One of our subcontractors was hit by a digital attack, and that’s why our checkouts aren’t working any more,” Coop Sweden, which accounts for around 20 percent of the sector, said in a statement.”We regret the situation and will do all we can to reopen swiftly,” the cooperative added.Ransomware Hits Hundreds of US Companies, Security Firm Says The REvil gang, a major Russian-speaking ransomware syndicate, appears to be behind the attackCoop Sweden did not name the subcontractor or reveal the hacking method used against it beginning on Friday evening.But the attack comes as a wave of ransomware attacks has struck worldwide, especially in the United States.Ransomware attacks typically involve locking away data in systems using encryption, making companies pay to regain access.Last year, hackers extorted at least $18 billion using such software, according to security firm Emsisoft.US IT company Kaseya on Friday urged customers to shut down servers running its VSA platform after dozens were hit with ransomware.In recent weeks, such attacks have hit oil pipelines, health services and major firms, and made it onto the agenda of US President Joe Biden’s June meeting with Russian counterpart Vladimir Putin.

‘Hams’ Head Outdoors for Remote Communication

Amateur or “ham” radio operators sometimes take their two-way radios to remote locations and talk to people around the world using battery power and portable antennas.  As Mike O’Sullivan reports, they are making friends and preparing for emergencies.
Camera: Mike O’Sullivan

Ransomware Hits Hundreds of US Companies, Security Firm Says

A ransomware attack paralyzed the networks of at least 200 U.S. companies Friday, according to a cybersecurity researcher whose company was responding to the incident.  The REvil gang, a major Russian-speaking ransomware syndicate, appears to be behind the attack, said John Hammond of the security firm Huntress Labs. He said the criminals targeted a software supplier called Kaseya, using its network-management package as a conduit to spread the ransomware through cloud-service providers. Other researchers agreed with Hammond’s assessment. “Kaseya handles large enterprise all the way to small businesses globally, so ultimately, [this] has the potential to spread to any size or scale business,” Hammond said in a direct message on Twitter. “This is a colossal and devastating supply chain attack.”  Such cyberattacks typically infiltrate widely used software and spread malware as it updates automatically. It was not immediately clear how many Kaseya customers might be affected or who they might be. Kaseya urged customers in a statement on its website to immediately shut down servers running the affected software. It said the attack was limited to a “small number” of its customers.’SolarWinds with ransomware’Brett Callow, a ransomware expert at the cybersecurity firm Emsisoft, said he was unaware of any previous ransomware supply-chain attack on this scale. There have been others, but they were fairly minor, he said. “This is SolarWinds with ransomware,” he said. He was referring to a Russian cyberespionage hacking campaign discovered in December that spread by infecting network management software to infiltrate U.S. federal agencies and scores of corporations. Cybersecurity researcher Jake Williams, president of Rendition Infosec, said he was already working with six companies hit by the ransomware. It’s no accident that this happened before the Fourth of July weekend, when IT staffing is generally thin, he added. “There’s zero doubt in my mind that the timing here was intentional,” he said. Hammond of Huntress said he was aware of four managed-services providers — companies that host IT infrastructure for multiple customers — being hit by the ransomware, which encrypts networks until the victims pay off attackers. He said thousands of computers were hit. “We currently have three Huntress partners who are impacted with roughly 200 businesses that have been encrypted,” Hammond said. JBS attackHammond wrote on Twitter: “Based on everything we are seeing right now, we strongly believe this [is] REvil/Sodinikibi.” The FBI linked the same ransomware provider to a May attack on JBS SA, a major global meat processor. The federal Cybersecurity and Infrastructure Security Agency said in a statement late Friday that it was closely monitoring the situation and working with the FBI to collect more information about its impact. CISA urged anyone who might be affected to “follow Kaseya’s guidance to shut down VSA servers immediately.” Kaseya runs what’s called a virtual system administrator, or VSA, that’s used to remotely manage and monitor a customer’s network. The privately held Kaseya says it is based in Dublin, Ireland, with a U.S. headquarters in Miami. The Miami Herald recently described it as “one of Miami’s oldest tech companies” in a report about its plans to hire as many as 500 workers by 2022 to staff a recently acquired cybersecurity platform. Brian Honan, an Irish cybersecurity consultant, said by email Friday that “this is a classic supply chain attack where the criminals have compromised a trusted supplier of companies and have abused that trust to attack their customers.” He said it can be difficult for smaller businesses to defend against this type of attack because they “rely on the security of their suppliers and the software those suppliers are using.” Recovery might be easierThe only good news, said Williams, of Rendition Infosec, is that “a lot of our customers don’t have Kaseya on every machine in their network,” making it harder for attackers to move across an organization’s computer systems. That makes for an easier recovery, he said. Active since April 2019, the group known as REvil provides “ransomware as a service,” meaning it develops the network-paralyzing software and leases it to so-called affiliates who infect targets and earn the lion’s share of ransoms.  REvil is among ransomware gangs that steal data from targets before activating the ransomware, strengthening their extortion efforts. The average ransom payment to the group was about $500,000 last year, said the Palo Alto Networks cybersecurity firm in a recent report. Some cybersecurity experts predicted that it might be hard for the gang to handle the ransom negotiations, given the large number of victims — though the long U.S. holiday weekend might give it more time to start working through the list. 

Chinese Hackers Attacked Afghan Council Network, Cybersecurity Firm Says 

As part of a cyberespionage operation targeting Central Asian countries, Chinese hackers recently sought to breach the computer networks of Afghanistan’s National Security Council, researchers at cybersecurity firm Check Point reported.The alleged attack by the Chinese-speaking hacking group known to cybersecurity experts as IndigoZebra is the latest in an operation that goes back as far as 2014 and has targeted political entities in neighboring Uzbekistan and Kyrgyzstan, the researchers wrote in a FILE – An iPhone displays a Facebook page, Aug. 11, 2019. Facebook said March 24, 2021, that hackers in China had used fake accounts and impostor websites in a bid to break into the phones of Uyghur Muslims.This is the first major Chinese cyberespionage operation in Afghanistan to come to light, coming just weeks after An icon for the Pulse Secure smartphone app, right, and a computer desktop info page are seen in Burke, Va., June 14, 2021. Suspected Chinese hackers penetrated U.S. entities’ computers in what cybersecurity experts called a major espionage campaign.China conducts large-scale cyberespionage operations around the world, cybersecurity experts say. In its latest threat assessment to Congress, the U.S. intelligence community wrote in April that China “presents a prolific and effective cyberespionage threat, possesses substantial cyber-attack capabilities, and presents a growing influence threat.”The Chinese Embassy in Washington did not respond to a request for comment.Check Point researchers said they investigated the cyberattack in Afghanistan after stumbling upon a suspicious email on a website that detects malware in email communications. The email had been apparently posted by one of its recipients on the Afghan National Security Council, according to Alexandra Gofman, the lead investigator on the Check Point team that probed the operation.Khalid Mafton of VOA’s Afghan Service contributed to this report.

Microsoft Exec Says Targeting of Americans’ Records ‘Routine’

Federal law enforcement agencies secretly seek the data of Microsoft customers thousands of times a year, according to congressional testimony Wednesday by a senior executive at the technology company.Tom Burt, Microsoft’s corporate vice president for customer security and trust, told members of the House Judiciary Committee that federal law enforcement in recent years has been presenting the company with between 2,400 to 3,500 secrecy orders a year, or about seven to 10 a day.”Most shocking is just how routine secrecy orders have become when law enforcement targets an American’s email, text messages or other sensitive data stored in the cloud,” said Burt, describing the widespread clandestine surveillance as a major shift from historical norms.The relationship between law enforcement and Big Tech has attracted fresh scrutiny in recent weeks with the revelation that Trump-era Justice Department prosecutors obtained as part of leak investigations phone records belonging not only to journalists but also to members of Congress and their staffers. Microsoft, for instance, was among the companies that turned over records under a court order, and because of a gag order, had to then wait more than two years before disclosing it.Since then, Brad Smith, Microsoft’s president, called for an end to the overuse of secret gag orders, arguing in a Washington Post opinion piece that “prosecutors too often are exploiting technology to abuse our fundamental freedoms.” Attorney General Merrick Garland, meanwhile, has said the Justice Department will abandon its practice of seizing reporter records and will formalize that stance soon.Burt is among the witnesses at a Judiciary Committee hearing about potential legislative solutions to intrusive leak investigations.  House Judiciary Committee Chairman Jerrold Nadler said in opening remarks Wednesday that the Justice Department took advantage of outdated policies on digital data searches to target journalists and others in leak investigations. The New York Democrat said that reforms are needed now to guard against future overreach by federal prosecutors — an idea also expressed by Republicans on the committee.”We cannot trust the department to police itself,” Nadler said.Burt said that while the revelation that federal prosecutors had sought data about journalists and political figures was shocking to many Americans, the scope of surveillance is much broader. He criticized prosecutors for reflexively seeking secrecy through boilerplate requests that “enable law enforcement to just simply assert a conclusion that a secrecy order is necessary.”Burt said that while Microsoft Corp. does cooperate with law enforcement on a broad range of criminal and national security investigations, it often challenges surveillance that it sees as unnecessary, resulting at times in advance notice to the account being targeted.Among the organizations weighing in at the hearing was The Associated Press, which called on Congress to act to protect journalists’ ability to promise confidentiality to their sources. Reporters must have prior notice and the ability to challenge a prosecutor’s efforts to seize data, said a statement submitted by Karen Kaiser, AP’s general counsel.”It is essential that reporters be able to credibly promise confidentially to ensure the public has the information needed to hold its government accountable and to help government agencies and officials function more effectively and with integrity,” Kaiser said.  As possible solutions, Burt said, the government should end indefinite secrecy orders and should also be required to notify the target of the data demand once the secrecy order has expired.Just this week, he said, prosecutors sought a blanket gag order affecting the government of a major U.S. city for a Microsoft data request targeting a single employee there.”Without reform, abuses will continue to occur and they will occur in the dark,” Burt said.

Judge Dismisses Government Antitrust Lawsuits Against Facebook

A federal judge on Monday dismissed antitrust lawsuits brought against Facebook by the Federal Trade Commission and a coalition of state attorneys general, dealing a significant blow to attempts by regulators to rein in tech giants. U.S. District Judge James Boasberg ruled Monday that the lawsuits were “legally insufficient” and didn’t provide enough evidence to prove that Facebook was a monopoly. The ruling dismisses the complaint but not the case, meaning the FTC could refile another complaint. “These allegations — which do not even provide an estimated actual figure or range for Facebook’s market share at any point over the past 10 years — ultimately fall short of plausibly establishing that Facebook holds market power,” he said. The U.S. government and 48 states and districts sued Facebook in December 2020, accusing the tech giant of abusing its market power in social networking to crush smaller competitors and seeking remedies that could include a forced spinoff of the social network’s Instagram and WhatsApp messaging services. The FTC had alleged Facebook engaged in a “a systematic strategy” to eliminate its competition, including by purchasing smaller up-and-coming rivals like Instagram in 2012 and WhatsApp in 2014. New York Attorney General Letitia James said when filing the suit that Facebook “used its monopoly power to crush smaller rivals and snuff out competition, all at the expense of everyday users.” Boasberg dismissed the separate complaint made by the state attorneys general, as well. 
 

Ukrainian Member of Cybercrime Gang Sentenced in US

A Ukrainian hacker was sentenced to seven years in prison for his role in a notorious cybercrime group that stole millions of credit and debit card details from across the United States, the Department of Justice said Thursday.Andrii Kolpakov, 33, was also ordered to pay $2.5 million in restitution after pleading guilty to one count of conspiracy to commit wire fraud and one count of conspiracy to commit computer hacking, the department said in a press release.Kolpakov’s lawyer, Vadim Glozman, said his client was disappointed with the sentence but respected the judge’s decision.He said Kolpakov — who has already spent three years in custody after being apprehended by police in Spain in 2018 — planned to return to Ukraine after serving out the remainder of his sentence.Kolpakov was sentenced in the Western District of Washington. Glozman said that his client was currently in custody in Washington state.Kolpakov’s gang — dubbed “FIN7” — is among the most prolific cybercriminal enterprises in existence. A memo drawn up by U.S. prosecutors said that “no hacking group epitomizes the industrialization of cybercrime better,” alleging that the gang had over 70 people organized into discrete departments and teams, including a unit devoted to crafting malicious software and another unit composed of hackers who exploited victims’ machines.For cover, FIN7 masqueraded as a cybersecurity company called “Combi Security,” which claimed to be involved in penetration testing.Prosecutors say Kolpakov worked for FIN7 from at least April 2016 until his arrest in June 2018 and rose to become a midlevel manager directing “a small team of hackers” tasked with breaching victims’ computer systems and training new recruits to use FIN7’s malicious tools.

US Lawmakers in Marathon Debate on Big Tech Regulation Bills

U.S. lawmakers debated into the night Wednesday over details of legislation aimed at curbing the power of Big Tech firms with a sweeping reform of antitrust laws.The House Judiciary Committee clashed over a series of bills with potentially massive implications for large online platforms and consumers who use them.The legislation could force an overhaul of the business practices of Google, Apple, Amazon and Facebook, or potentially lead to a breakup of the dominant tech giants. But critics argue the measures could have unintended consequences that would hurt consumers and some of the most popular online services.Rep. David Cicilline, who headed a 16-month investigation that led to the legislation, said the bills are aimed at restoring competition in markets stymied by monopolies.”The digital marketplace suffers from a lack of competition. Many digital markets are defined by monopolies or duopoly control,” Cicilline said as the hearing opened.”Amazon, Apple, Facebook and Google are gatekeepers to the online economy. They bury or by rivals and abuse their monopoly power conduct that is harmful to consumers, competition, innovation and our democracy.”The bills would restrict how online platforms operate, notably whether tech giants operating them could favor their own products or services.The measures would also limit mergers or acquisitions by Big Tech firms aimed at limiting competition and make it easier for users to try new services by requiring data “portability” and “interoperability.”The fate of the bills remained unclear, with some Republicans and moderate Democrats expressing concerns despite bipartisan support.Clash points included whether it is right to target laws at four big tech companies and whether government agencies will hobble them instead of letting them adapt to competition.”The interoperability measure is a huge step backwards,” said Oregon Republican Cliff Bentz. “Big Tech is certainly not perfect. This bill is not the way to fix the problem.”Representative Zoe Lofgren said she hoped the bill would include more measures for data privacy and security but endorses the concept.“The big platforms have all your information. And if you can’t move it, then you’re really a prisoner of that platform,” she said. “Who wants to leave a platform if they’ve got all your baby pictures and all of your videos of your grandchildren, locked up?”As the session stretched into the night, some members of the body lobbied to adjourn and resume the work another day.’They make it worse’Republican Representative Ken Buck, a supporter of the overhaul, said the legislation “represents a scalpel, not a chainsaw, to deal with the most important aspects of antitrust reform,” in dealing with “these monopolists (who) routinely use their gatekeeper power to crush competitors, harm innovation and destroy the free market.”But Representative Jim Jordan, a Republican, criticized the effort, renewing his argument that Big Tech firms suppress conservative voices.”These bills don’t fix that problem — they make it worse,” Jordan said. “They don’t break up Big Tech. They don’t stop censorship.”Steve Chabot, another Republican, called the initiative “an effort for big government to take over Big Tech.”The panel approved on a 29-12 vote a bill that was the least controversial, increasing merger filing fees to give more funding for antitrust enforcement.Tech firms and others warned of negative consequences for popular services people rely on, potentially forcing Apple to remove its messaging apps from the iPhone or Google to stop displaying results from YouTube or Maps.Apple released a report arguing that one likely impact — opening up the iPhone to apps from outside platforms — could create security and privacy risks for users.Forcing Apple to allow “sideloading” of apps would mean “malicious actors would take advantage of the opportunity by devoting more resources to develop sophisticated attacks targeting iOS users,” the report said.Amazon vice president Brian Huseman warned of “significant negative effects” both for sellers and consumers using the e-commerce platform, and reduced-price competition.”It will be much harder for these third-party sellers to create awareness for their business,” Huseman said.”Removing the selection of these sellers from Amazon’s store would also create less price competition for products, and likely end up increasing prices for consumers. The committee is moving unnecessarily fast in pushing these bills forward.”The measures may also impact other firms including Microsoft, which has not been the focus of the House antitrust investigation but which links services such as Teams messaging and Bing search to its Windows platform, and possibly other firms.