Last night around 11:00 PM EST, Beacon was brought back online by LBP Union Research and Development. Since we have not received our NCMEC service provider credentials yet, Senior Developer Kokofloral introduced a new commit to Project Lighthouse that enabled us to open the server back up in a read-only state. This means that we can safely continue operating the server until we receive those credentials. However, the following features will be unavailable in the meantime:
- Level uploads
- Profile changes
- Photo uploads
- Comments
- Reviews
- Mostly anything else that requires uploads or changes to the server.
However, you will still be able to play published levels, see previously posted content, and do matchmaking with other players.
The question everyone wants to know the answer to is: when will we receive those service provider credentials and enable uploads again? On March 26th, I reached out to the NCMEC for confirmation that our request was received and I asked for an ETA. They confirmed that they had received our application, but unfortunately did not give me an ETA on when our application would be reviewed and completed.
I want to thank everyone for your heartfelt support and understanding during this time. I sincerely apologize for the further delay. We remain committed to communicating with you all about this process as much as possible.
The following is our update statement from March 26th at 12:00 PM EST:
On March 25th at 4:34 PM, Beacon was shut down for temporary critical security maintenance. I am writing this message to inform you about what’s going on and why we needed to shut the server off, and why the server is still offline past our ETA.
First, let me begin by saying that LBP Union takes user safety extremely seriously. If we have to temporarily shut off the service to protect players, we will. We are committed to communicating about outages as much as reasonably possible to keep you informed about when they will return.
It was brought to our attention that since Beacon allows user generated content to be uploaded to the service, it might be possible for Child Sexual Abuse Material (CSAM) to be uploaded to the service. This type of content cannot be reasonably handled in a normal manner compared to most other content that we moderate. We have a zero-tolerance policy for CSAM on Beacon. As of this moment, we do not have a reliable way to ensure that Beacon is free of CSAM content. Simply watching our content streams and waiting for user reports is not an acceptable form of moderation of this content to us. As a result, we decided that it was too risky to continue running Beacon until we could find a way to reliably respond to this kind of content.
In addition, we need a reliable way to report CSAM content to the authorities and immediately block it. That’s why we have pursued obtaining service provider credentials with the National Center for Missing and Exploited Children (NCMEC). With these credentials, we can activate a Cloudflare feature, their CSAM scanning tool, to automatically identify, quarantine, and report CSAM content posted to Beacon.
The Cloudflare CSAM scanning tool works like this:
- Cloudflare scans our website and Beacon and watches for resources that contain CSAM content.
- If CSAM content is detected, it blocks the resource(s) from being accessed by other users.
- Cloudflare will inform us of the resource detection what resources were blocked. It will automatically report the detection with details to the NCMEC.
- We are legally obligated to securely maintain a copy of the blocked material for 90 days in case law enforcement or the NCMEC requires the resource(s) and other information we may have. After that, the content will be deleted. We will permanently ban and IP block any account responsible for posting the content.
We have applied for these credentials. However, we aren’t sure exactly when to expect to get them. Once we obtain the credentials, we can activate the CSAM scanning tool on our Cloudflare account. Once this feature is active, we will be able to safely reactivate Beacon services.
Since we have applied for credentials but have not yet received them as of the writing of this message, I have contacted the NCMEC and asked for an update about when we can expect to receive our credentials, as this will impact when we can restore service. I currently expect they will return my message within the coming days, and hopefully we will be able to get our credentials by the end of the week. Unfortunately, I can’t perfectly predict the future. If there are further delays or an update to the ETA, we will inform the community immediately.
Thank you for your continued patience and we apologize for the continued downtime of Beacon.
FAQ
Why Was There Such Little Notice?
We judged that the threat of CSAM material being posted to Beacon was severe enough to warrant shutting down the server immediately. Upon deciding that it was necessary to activate Cloudflare’s CSAM scanning tool, we acted accordingly.
How Long Will Beacon Be Offline?
Beacon will be offline until we can enact a solution that will allow people to play online without risk of being exposed to CSAM. The most important variable is for us to receive our service provider credentials from the National Center for Missing and Exploited Children (NCMEC) so that we can activate Cloudflare’s CSAM scanning tool. Once we receive those credentials, we can take the next step to ensure that Beacon is secure from CSAM content and reactivate services.
Where Can I Be Notified About Server Status Updates?
You have several options to get server status updates:
- Join our Discord server to get notified as soon as Beacon comes back online. Make sure you are opted into the server status announcement role.
- Follow us on Twitter.
- Bookmark this page to see updates (you will not receive a push notification.)
- Bookmark our status page to see status updates (you will not receive a push notification).
The following message was posted on our Discord server’s status history channel shortly after service was brought offline:
Beacon is going offline while we await installation of a critical security feature to protect the community. We take your safety seriously, and we are committed to continuing to communicate about the downtime, our reasons for doing so, and how other LittleBigPlanet custom server operators can protect their players.
The downtime will last until the security feature can be implemented. Our current estimation of when downtime will be completed is Tuesday, March 26th at 12:00 PM EST. However, service may be restored before or after this timeframe depending on when we can get the feature enabled. Should it take longer than this timeframe, we will update you with the best possible ETA.
We will continue to provide more details about what we’re up to over the coming days. Please believe me: after the official server shutdowns I am just as frustrated as you are with outages. However, our primary goal is your safety. To support that, we are committed to communicating with you as best as we can about the outage.
Team Pick Tuesdays has currently been postponed to next Tuesday.
You can track the downtime on our status page.. Thank you for your patience, and we apologize for the inconvenience.
