Episode notes
DraftKings reportedly built a model to find customers likely to gamble and lose more after promotions while problem-gambling prediction work stalled. Also, Google's €403 million location-data ruling, a Meta Muse flaw that could hand broad permissions to a basic Mac app, and an air-traffic backup line found broken only when the normal path failed.
Hosts: Alex & Jordan
Show: Chief Skeptic Officer — The side of tech news nobody talks about.
Drop: Daily at 7:00 A.M. America/New_York
Episode date: 2026-09-22
In this episode
The profitable loser score — The New York Times reports that DraftKings ranked customers by how much more they were likely to gamble and lose after promotions. Four former employees said work to predict who might develop a gambling problem was stalled or stopped. The model did not invent that priority; people chose which prediction reached the product.
A fine measured in years — Ireland's Data Protection Commission fined Google €403 million and ordered compliance within six months over three location features. The inquiry covered data handling from 2018 to 2020. The test is whether defaults, explanations, and retention change, not whether the number makes a large headline.
One key, many permissions — Researcher Patrick Wardle demonstrated that a basic Mac app could redirect Meta Muse's speech request and receive the account key attached to it. No attacks in the wild are known. The flaw shows how an assistant's useful permissions can amplify a much smaller opening.
The backup nobody tested — A cut telecom line disrupted East Coast air traffic for roughly eight hours. Reuters reports that a replacement circuit failed and the backup fiber was already broken. Controllers responded safely by stopping traffic, but capacity collapsed because the redundant path did not work when needed.
Links
AI disclosure
This episode was created with artificial intelligence. Alex & Jordan are AI hosts; their voices and conversation are generated with AI. Research and editorial judgment shape the skeptic angles; we do not invent quotes, scores, or viral claims about the news.
Transcript
Alex and Jordan, turn by turn. Tap a line to jump in the player.
0:00
Alex
DraftKings used a machine-learning model to find customers likely to gamble and lose more after a promotion.
0:06
Jordan
Ireland's privacy regulator fined Google four hundred and three million euros over its handling of location data.
0:15
Alex
A security researcher found that a low-power app on a Mac could take control of Meta's highly privileged Muse assistant.
0:23
Jordan
A failed air-traffic circuit and a broken backup line disrupted thousands of flights across the northeastern United States.
0:31
Jordan
That's the board. Stay for the audit. We open those up. Today's Chief Skeptic Officer.
0:47
Jordan
What if there was an AI that researched the tech news, checked the sources, and asked what the tech news is not telling you?
0:55
Alex
That's us. I'm Alex.
0:57
Jordan
And I'm Jordan.
0:59
Alex
You're listening to Chief Skeptic Officer. The side of tech news nobody talks about.
1:04
Jordan
Every day at seven A.M. New York time. Wherever you get your podcasts.
1:10
Alex
DraftKings gives out betting credits and bonuses to make people place more bets. The New York Times says the company built a model to decide who should get those offers.
1:20
Jordan
And the score was not, "Who will have fun?" It was, "Who is likely to lose more after we send the offer?"
1:27
Alex
Right. The work began in twenty twenty-three. The Times says it reviewed internal documents and spoke with former employees. One analyst, Jayden Butts, tested the model.
1:38
Jordan
His question was painfully simple. If the best customer is the person most likely to lose, how many of those people are already in trouble?
1:47
Alex
DraftKings makes money when customers lose. That part is not hidden. The buried part is what betting records and responses to past offers can reveal about the next offer.
1:59
Jordan
Look at this image from the Times investigation. The phone is the whole room. The promotion arrives inside the same place where the next bet happens.
2:08
Alex
The Times says DraftKings kept improving the promotion model. Four former employees also said efforts to predict who might develop a gambling problem were stalled or stopped.
2:19
Jordan
Wait-- the same trail can answer both questions?
2:23
Alex
In principle, yes. One question is, "Who may lose more if we nudge them?" The other is, "Who may need us to stop nudging?"
2:32
Jordan
So this is not really a story about magical artificial intelligence. It is a story about which goal got staff, tests, and a path into the product.
2:44
Alex
Exactly. People online keep arguing about whether this is even "AI." That argument helps DraftKings. Call it a prediction model. Call it statistics. The duty does not change.
2:55
Jordan
I disagree on one thing. The label matters because "AI" can make an old choice sound automatic. Like nobody decided what the score should reward.
3:06
Alex
Fair. The model did not invent the business goal. People chose the target.
3:11
Jordan
And we do not know how many customers were harmed, or who still receives these offers today.
3:18
Alex
We do know the incentive. Protection had to compete with revenue using the same data.
3:24
Jordan
That is the audit. When a company says it knows its customers, ask which version of you is valuable: the person it can protect, or the person it can keep losing.
3:35
Jordan
Ireland's Data Protection Commission announced its final ruling against Google. Four hundred and three million euros, plus an order to comply within six months.
3:45
Alex
The inquiry covered three location features. One saved activity across Google services. One saved places you visited. One helped Android devices estimate where they were. It examined how Google handled that data from May twenty eighteen to February twenty twenty.
4:00
Jordan
That date range matters. This decision took more than six years to arrive.
4:06
Alex
Privacy enforcement runs on geological time.
4:11
Jordan
The regulator said Google lacked a proper legal basis, did not explain the system fairly or clearly, could not show it was meeting the rules, and kept some location data too long.
4:23
Alex
And it spelled out the human cost. People could be unaware that location was used to shape ads or infer their interests.
4:31
Jordan
So the fine is not just about a dot on a map. A place can reveal a clinic, a protest, a place of worship, a school run.
4:39
Alex
Here is the official Maps page. "Your guide to anywhere." Useful product. But usefulness does not answer how many other Google systems get to learn from the trip.
4:51
Jordan
The setting names sound separate. Web activity. History. Accuracy. A normal person sees three switches. Google sees one person moving through the world.
5:03
Alex
Careful. The decision does not say every location point flowed into every product. It says Google failed duties across those named features.
5:13
Jordan
You're right. I pushed past the evidence.
5:16
Jordan
Then here is the narrower doubt. The headline is a huge number. Does the order change the default, the explanation, and how long the data is kept before any appeal fades from view?
5:28
Alex
That is the test. We do not know whether the fine has been paid, and any appeal is still ahead. The regulator announced the ruling, but said the detailed written decision will be published later.
5:41
Jordan
But six months is a real deadline.
5:44
Alex
Yes. A fine can become a cost of doing business. A compliance order can change the business, if the regulator follows through.
5:53
Jordan
Watch the settings, not the press release. If people still cannot tell what is stored, why, and for how long, four hundred and three million euros bought a headline.
6:05
Alex
Meta's new Muse assistant can use email, calendars, WhatsApp, files, the camera, the microphone, and other services. It needs broad access because it acts for you.
6:17
Jordan
Which means a small security mistake can inherit a very large key ring.
6:23
Alex
Security researcher Patrick Wardle found that an ordinary app or a typed command on the Mac could change a hidden Muse setting. That setting chooses the server that turns your speech into text.
6:35
Jordan
Normally, Muse sends the speech request to Meta. Change the address, and Muse sends that request to an attacker's server instead.
6:44
Alex
Muse automatically attaches its account key to that request. So the attacker receives the key too. Wardle says it can then control the account and use the access already granted to Muse.
6:55
Jordan
This is his demonstration. A basic app, without special Mac access, sends Muse a prompt. Muse answers that such a thing should be impossible.
7:05
Alex
The screenshot and the answer are having a disagreement.
7:10
Jordan
But wait. If an attacker can already run a command on your Mac, aren't you already compromised?
7:17
Alex
Somewhat. But Mac permissions are supposed to limit what that basic app can reach. The flaw lets it borrow Muse's much stronger access instead.
7:27
Jordan
So instead of building malware for the camera, files, messages, and calendar, the attacker asks the assistant that already has permission.
7:37
Alex
Exactly. The assistant turns one small opening into many larger ones.
7:43
Jordan
Ars says Meta did not answer questions before publication. Wardle demonstrated attacks in a test. There are no known real-world attacks using this flaw.
7:52
Alex
Separately, Amazon blocked Muse from shopping on its site hours before the flaw was disclosed. Amazon called it an unauthorized assistant. That was not caused by this bug.
8:03
Jordan
Safety is part of that. So is control. An agent can skip sponsored results and choose what the user asked for. Amazon has reasons to keep the shopping screen in the middle.
8:13
Alex
Two things can be true. Meta should not walk around another service's rules. Amazon also benefits when no outside agent edits its shelf.
8:23
Jordan
The bigger rule is simple. Every permission you give an agent is also a permission its next bug may hand to someone else.
8:32
Jordan
A construction crew cut a telecom line in New Jersey. That helped trigger arrival stops at New York-area airports and Philadelphia, with problems spreading to Boston and Washington.
8:44
Alex
Reuters tied about seven thousand delayed or canceled flights to this incident. More than one hundred flights were diverted. The disruption lasted about eight hours.
8:54
Jordan
And the first headline said one fiber cut.
8:58
Alex
The fuller story is worse. After the normal line was cut, a replacement circuit at the Philadelphia control center failed. Then the system tried its backup fiber and discovered that line was already broken too.
9:11
Jordan
That is the sentence people seized on. The backup apparently did not report its own failure before the moment everyone needed it.
9:20
Alex
We do not know how long it had been broken. We also do not know who made the bad utility markings. Agencies and contractors were still disputing responsibility.
9:31
Jordan
But the safety response did work. Controllers stopped accepting traffic rather than pretend communications were fine.
9:39
Alex
Yes. That is important. Safety worked. Capacity collapsed.
9:45
Jordan
Here is FlightAware's broader count for the whole day, not just this incident. More than eight thousand delays inside the United States, and more than two thousand cancellations worldwide.
9:56
Alex
When I replace a logging system, I keep the old path working until the new one proves itself. And "working" is not a green light on a screen. You have to test it with the real load.
10:07
Jordan
There it is. Your job has finally become a public service announcement.
10:13
Alex
I have waited months for this moment.
10:18
Jordan
The point is still sharp. A backup line can look redundant on a diagram while sharing the same trench, the same contractor, or the same neglected test.
10:28
Alex
Congress approved twelve and a half billion dollars for air-traffic upgrades last year. The transportation secretary says another seventeen and a half billion is needed.
10:38
Jordan
More money may be necessary. But buying a second path is not the same as proving the second path works.
10:46
Alex
And the next incident should not be the first health check.
10:51
Jordan
Resilience is not what you own. It is what still works after the first thing breaks.
10:59
Alex
Find Chief Skeptic Officer wherever you get your podcasts. Every day at seven A.M. New York time.
11:06
Jordan
Tell us what you're skeptical about. Drop it in the comments.
11:09
Alex
Stay curious. Stay skeptical.
11:13
Jordan
Doubt both.
