This Is A Really Bad Idea: Facebook, Twitter, YouTube & Microsoft Agree To Block 'Terrorist' Content

from the how's-that-going-to-work dept

Under increasing pressure from overreacting and fearful bureaucrats, it seems that the big social media companies -- Facebook, Twitter, YouTube and Microsoft -- have all agreed to block "terrorist" content and will agree to share hashed versions of it among the other companies so something blocked on one site can easily be blocked across them all.

Facebook, Microsoft, Twitter and YouTube are coming together to help curb the spread of terrorist content online. There is no place for content that promotes terrorism on our hosted consumer services. When alerted, we take swift action against this kind of content in accordance with our respective policies.

Starting today, we commit to the creation of a shared industry database of “hashes” — unique digital “fingerprints” — for violent terrorist imagery or terrorist recruitment videos or images that we have removed from our services. By sharing this information with each other, we may use the shared hashes to help identify potential terrorist content on our respective hosted consumer platforms. We hope this collaboration will lead to greater efficiency as we continue to enforce our policies to help curb the pressing global issue of terrorist content online.

Our companies will begin sharing hashes of the most extreme and egregious terrorist images and videos we have removed from our services — content most likely to violate all of our respective companies’ content policies. Participating companies can add hashes of terrorist images or videos that are identified on one of our platforms to the database. Other participating companies can then use those hashes to identify such content on their services, review against their respective policies and definitions, and remove matching content as appropriate.

This sounds as though it's modeled on similar arrangements around child pornography. Except that there are some major differences between child pornography and "terrorist content." The first is that child porn is de facto illegal. "Terrorist content" is quite frequently perfectly legal. It's also much more of a judgment call. And based on this setup, allowing one platform partner to designate certain content as "bad" will almost certainly result in false positive designations that will flow across multiple platforms. That's dangerous.

As we've discussed in the past, when you tell platforms to block "terrorist" content, it will frequently lead to mistakes, like blocking humanitarians documenting war atrocities. That kind of information is not just valuable, but necessary in understanding what's happening.

Also, all of this presumes, that the best way to deal with so-called "terrorist content" online is to hide it and pretend it doesn't exist. That's not always the case. As we've noted, counterspeech -- including mocking silly terrorist claims -- is often much more effective than outright blocking. Blocking the content not only leads to a slippery slope -- and open questions on choosing what content stays and what content goes -- but also presumes that the block is the most effective way to stop the bad behavior associated with terrorists. But it leaves out that blocking such content often only makes those posting it feel like they're on the right path, and that they're saying something "so true" that it needs to be blocked. It's not a path towards stopping terrorism or the spread of terrorist ideology -- it just gets those engaged to dig in deeper on their views.

On top of that, terrorist information posted to social media is often a great source of intelligence for law enforcement. Even the FBI director has said it's silly to chase terrorists off of social media, because it makes them harder to track. So what good is this really doing?

Yes, platforms have every right to decide how they want to handle the content submitted to them. And, yes, this almost certainly comes about as a result of increasing pressure (especially out of the EU) to "do something" about "terrorist content" on these platforms, but as we've seen in the past, appeasing such whining bureaucrats almost never settles them down. As we recently noted, after these same four companies signed an agreement earlier this year to "curb hate speech" on their platforms, it still didn't stop government officials in Europe from threatening further legal consequences, including criminal charges, when the agreed upon blocks failed to magically make all "hate speech" disappear.

So, yes, the platforms may have felt backed into a corner, but they're only going to get their backs pushed further and further into that corner -- and the collateral damage it creates may be even more massive.

Filed Under: blocking, social media, terrorist content
Companies: facebook, microsoft, twitter, youtube

Russia Orders LinkedIn's Service To Be Blocked, Supposedly For Failing To Store Personal Data Locally

from the think-globally,-act-locally dept

Techdirt has written plenty of stories about Vladimir Putin's increasingly harsh clampdown on Internet freedom. But, like China, Russia is still coming up with new ways to tighten its control. One is the legal requirement that the personal data of Russian citizens must be stored on Russian soil. Now, a US company has fallen afoul of that 2015 law:

Russia's communications regulator [Roskomnadzor] ordered public access to LinkedIn's website to be blocked today (17 November) to comply with a court ruling that found the social networking firm guilty of violating data storage laws.

According to the EurActiv story, the ban is being put in place immediately:

LinkedIn's site will be blocked within 24 hours, the Interfax news agency cited Roskomnadzor spokesman Vadim Ampelonsky as saying. One internet service provider, Rostelcom, said it had already blocked access to the site.

What's curious is that LinkedIn is not the only US company to have flouted Russia's data localization law: both Google and Facebook have also ignored it. A post on NBC News suggests the following is the reason for that discrepancy:

A spokesman for the [Roskomnadzor] watchdog had earlier said that LinkedIn was punished for alleged leaks of user data, Russian media reported.

Information about 120 million LinkedIn user accounts was stolen in 2012, the attack reportedly blamed on Russian hackers.

Irrespective of the messy details of the LinkedIn case, requirements that personal data must be stored locally are likely to become an increasingly hot topic. Already, the EU is unwilling to finalize the Trade in Services Agreement (TISA) in part because of US demands that it should include unrestrained data flows -- something that could be illegal under EU privacy laws if applied to personal information.

With the person who will soon run the CIA keen on expanded government spying powers, it is almost certain that the current Privacy Shield framework, which allows the personal data of EU citizens to be sent to the US, will be struck down by the Court of Justice of the European Union. If that happens, the only way companies like Google, Facebook -- and LinkedIn -- would be able to operate in the EU would be to store their data on the continent. If they fail to comply, they won't be blocked, as in Russia, but they could be hit with a fine of up to 4% of their global turnover.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: data hosting, localization, russia, tisa
Companies: linkedin, microsoft

Belgian Court Fines Microsoft For Failing To Comply With Its Impossible Order

from the we-said-JUMP dept

You can't always get what you want. But if you try sometime, you just might fine... a company for being unable to deliver on the impossible.

Belgium has fined Skype €30,000 for failing to comply with a court request to intercept users' communications, something Skype claims was technically impossible at the time of the request.

According to Het Belang van Limburg, a Dutch-language newspaper in Belgium, the fine was delivered by the court in Mechelen because Skype had failed, in September 2012, to deliver up anything more than metadata in response to an investigation into a criminal organisation.

The court, failing to understand anything but its power to order people around, demanded that Skype turn over communications. Skype turned over the only thing it could actually obtain, explaining that its architecture didn't support the interception of calls. No dice. That only made the court angry.

The court was no more happy to have pointed out to it that Microsoft didn't actually fall under its jurisdiction. It maintains no data centers in Belgium, nor does it have anyone employed there. Microsoft suggested the court work with governments of countries where it actually maintains a presence and utilize their mutual assistance treaties.

None of these facts appear to have mattered. The court says Microsoft should be able to do the impossible because the law is the law.

Het Belang van Limburg quoted prosecutor Tim Hoogenbemt as saying: "Skype offers services in our country, so it needs to know the laws. And therefore know that the court may ask interception measures."

Sometimes the law isn't the law, though. Microsoft pointed out the law doesn't actually apply to it since it's a software provider, rather than a service provider.

And sometimes the law is an ass. The fine is still in place despite arguments of impossibility, illegality, and "not applicable" to the contrary. It may not stick. Microsoft is appealing the decision.

This isn't the first time Belgian courts have overreached. Back in 2009, Belgian officials blew off perfectly workable mutual assistance treaties, demanding user information directly from Yahoo's US headquarters. Yahoo, like Microsoft, pointed out that it has no data centers or employees in Belgium. Instead of rethinking its approach, the government took the company to criminal court. That court, like this one, decided to fine the company for doing the exact thing it was supposed to be doing: protecting its users' privacy.

And that's not the limit of Belgian exceptionalism. A "royal decree" from the Belgian government (which bypasses the Parliamentary approval process needed for actual legislation) forces ISPs to collect and store tons of info on their subscribers, including how many emails are sent, VoIP use (hello, Skype!), call metadata, etc. -- just in case law enforcement might need it. When it was pointed out this decree violated the EU's privacy directive, the government shrugged and called the agreement it signed "obsolete."

Given these decisions, it's not even useful advice to suggest just not doing business in Belgium. It quite obviously doesn't matter to the courts where the data or communications they're seeking are actually located.

Filed Under: belgium, intercept, phone calls, skype, warrant
Companies: microsoft, skype

Government Seeks Do-Over On Win For Microsoft And Its Overseas Data

from the please-please-please-let-me-get-what-I-want dept

The DOJ wants the Second Circuit Court of Appeals to revisit the decision it handed down in July -- the one that's preventing it from forcing Microsoft to hand over data stored on its servers in Ireland. The DOJ hoped the court would read the Stored Communications Act as applying to the location of the company served with the data request, rather than the actual location of the data. The Appeals Court disagreed with the lower court's finding -- one that dragged in the Patriot Act for some reason -- pointing out that the purpose of the SCA was to protect the privacy of communications, not to facilitate the government in obtaining them.

The government has filed a petition [PDF] for a rehearing of the case, obviously in hopes of a reversal. Jennifer Daskal of Just Security has posted several reasons why the DOJ's desired interpretation of the Stored Communications Act is dangerous, along with other problems arising from this decision.

To begin with, the decision raises new logistical issues, both for the government and the private companies served with these warrants.

According to the government, companies like Google and Yahoo! now need to ascertain the location of sought-after data “at the moment the warrant is served.” If the content is stored abroad, it is now “beyond the reach of a Section 2703 warrant, even when the account owner resides in the United States and the crime under investigation is entirely domestic.”

The court's interpretation of the SCA theoretically means Google will never again have to turn over requested emails to law enforcement.

Moreover, in the case of Google, this data is also outside the reach of a MLA request “because only Google’s US-based employees can access customer email accounts, regardless of where they are stored.” (p.6) In other words, US law enforcement cannot access the data because it is outside the reach of the US warrant authority. And foreign governments cannot because they lack jurisdiction over the US-based employees that control the data. No law enforcement official can access it anywhere.

That being said, Daskal points out that the government also feels that just because it has a warrant, it should be able to demand the production of communications wherever, whenever. This flat assertion that warrants trump privacy in every case is every bit as one-sided as the DOJ's theory that Google now has the option to rebuff warrants at its sole discretion.

The DOJ's fears aren't entirely unfeasible. Companies that sell their communications tools with privacy-heavy sales pitches could simply offshore their data storage to put it out of reach of SCA-citing warrants, turning the 2nd Circuit's ruling into a middle finger to US law enforcement.

If this is going to be fixed in any sort of way that doesn't turn this into a one-sided victory for service providers or the government, it's probably going to need to be through legislation. The court's revisitation of the issue (courts have generally been favorable to rehearing requests from the US government) may come to that very conclusion.

Indeed, the DOJ has already begun pushing for a legislative solution, albeit one that heavily favors the government. The DOJ wants existing Mutual Legal Assistance Treaties (MLATs) modified so the FBI, etc. can continue to compel the production of communications stored overseas without tripping over reluctant US service providers or statutory limitations built into the SCA.

As Daskal notes, Congress is better off addressing this issue sooner rather than later. Should the court reverse its decision and allow the FBI to demand communications from foreign data centers using nothing more than a warrant issued by a local magistrate, other countries far less concerned about US privacy protections will be sure to utilize the same tactics.

Yet I continue to have concerns about the result of a governmental win: the government gets free rein to compel any US-based provider to disclose any user’s data, without any constraint based on things like the location or nationality of the target. This is a rule that will be watched, and likely mimicked, by others.

Consider the broader implications: The United States would (or at least should) be concerned if foreign governments unilaterally demanded the unilateral production of US citizens and residents data. And in fact current US law prohibits US-based providers from responding to those demands—requiring that the foreign governments instead employ the MLA process and ultimately obtain a US warrant based on the US standard of probable cause. Foreign government also have an interest in controlling access to their residents data. Those interests ought to be taken into account.

Unfortunately, Congress doesn't really have a great track record when it comes to legislative fixes for tech issues. We have a more technologically-adept set of legislators than we've ever had previously, but there are still many who won't see the forest of implications for the law enforcement trees. But the situation may become much, much worse if left unattended.

Filed Under: doj, electronic surveillance, ireland, jurisdiction, stored communications, warrant
Companies: microsoft

Basically All Big Tech Companies Deny Scanning Communications For NSA Like Yahoo Is Doing

from the getting-more-interesting dept

So, the big story yesterday was clearly the report that Yahoo had secretly agreed to scan all email accounts for a certain character string as sent to them by the NSA (or possibly the FBI). There has been lots of parsing of the Reuters report (and every little word can make a difference), but there are still lots of really big questions about what is actually going on. One big one, of course, is whether or not other tech companies received and/or complied with similar demands. So it seems worth nothing that they've basically all issued pretty direct and strenuous denials to doing anything like what Yahoo has been accused of doing.

Twitter initially gave a "federal law prohibits us from answering your question" answer -- and a reference to Twitter's well documented lawsuit against the US government over its desire to reveal more details about government requests for info. However, it later clarified that it too was not doing what Yahoo was doing and had never received such a request. Microsoft's response was interesting in that it says it's not doing what Yahoo is, but refused to say if it had ever received a demand to do so. Google said it had never received such a request and would refuse to comply if it had. Facebook has also denied receiving such a request, and, like Google, says it would fight against complying. This still leaves lots of unanswered questions about why Yahoo gave in. Again, historically, Yahoo had been known to fight against these kinds of requests, which makes you wonder what exactly was going on here.

Former GCHQ infosecurity guy Matt Tait has one of the more more interesting threads about this news, arguing (in some ways) that it's both less and more than everyone is making it out to be. His basic argument is that this is an expansion of the PRISM program to include "about" targets. This has been discussed in the past, but under PRISM, the NSA could give tech companies "selectors" in the form of specific addresses and the companies were compelled to hand over emails "to" or "from" them -- but according to the PCLOB's report on the Section 702 program it did not include anyone emailing "about" the selector. Upstream collections (i.e., tapping the backbones from folks like AT&T) did include "about" selectors (and this information also flowed into other areas, enabling so called backdoor searches. And, as I speculated yesterday, Tait says that this latest news appears to be Yahoo now agreeing to use "about" selectors on its emails, which means that it's still part of PRISM, with a massive expansion.

Tait then notes that if James Clapper wants to clear this up, he should state publicly whether or not "about" collection is a part of PRISM. And if that's the case, he should also explain when and why PRISM was expanded to include this. But, of course, Clapper and the Intelligence Community tend not to want to explain very much of anything, leaving lots of people in the dark.

And, frankly, that's stupid. The Intelligence Community thinks that this keeps "bad guys" on edge, not knowing what's safe and what's not. But that's dumb. They mostly know to use more encrypted/secret means of communication when they need to. Instead, what you end up with is keeping the public on edge and not trusting services. I can almost guarantee that one of the early comments on this post will be some of you insisting that all the companies denying doing this are flat out lying. I don't agree with that, because the companies don't have a history of outright lying on things like this, but the way the NSA and other parts of the US government have repeatedly tried to pressure them and gag them, it's much tougher to take anything at face value any more. And that's not good for anyone.

Filed Under: about collection, about selectors, mass surveillance, nsa, prism, section 702, upstream
Companies: facebook, google, microsoft, twitter, yahoo

Lenovo Accused Of Locking Linux Out Of Certain Laptops At Microsoft's Request

from the that-would-be-dumb dept

A thread on Reddit is getting a fair bit of attention today, claiming that Lenovo has set up some of its Yoga laptops to block anyone from installing Linux -- and a Lenovo representative then pointed the finger at Microsoft, saying that it's part of what Lenovo was required to do as part of the Microsoft "Signature Edition" Windows 10 program, though there are reasons to doubt this is true. What is clearly true is that there's a problem installing Linux on a bunch of Lenovo machines. Here's a giant thread on the problems (which apparently disappeared for a while, but is back as I write this). And here's another. And here's another. Some of these threads go back many months. But the issue that has suddenly made it big news is a comment supposedly from a Lenovo "product expert" that the company is forced to block it as a part of the Signature Edition program: If you haven't heard of the Windows "Signature Edition," it's a program from Microsoft to offer a "clean" (read: no annoying bloatware) version of Windows. Think of it like a Google Nexus phone with a clean Android install, as compared to one from a carrier or handset maker stuffed with annoying bloatware you'll never use. The Signature Edition PCs have received some fairly glowing reviews -- and many (ironically given this story today) of the news stories about the Signature Edition program use the Lenovo Superfish malware fiasco as a reason for why people should look at a Signature Edition computer if they want to run Windows.

So, yeah, based on this storyline so far, you have Microsoft making a clean install of its operating system without bloatware (good idea!), but then being accused of making Lenovo design its BIOS to block the installation of Linux (bad idea!). There is at least some reasonable skepticism that the problem here is really because of the Microsoft Signature Edition program. First of all, Signature Edition computers are supposed to only be available directly via Microsoft's stores -- and the laptop that kicked this off was purchased at Best Buy. Also it wasn't labeled as a Signature Edition PC. And it's certainly not unheard of for low level employees in forums to post incorrect information -- and there is even some question as to whether or not the "Lenovo Product Expert" in the forum post above is even a Lenovo employee or a third-party contractor anyway.

So whether Microsoft is truly to blame here is still an open question. At the very least, it does seem like Lenovo has some questions to answer -- and one hopes that the company will be more forthright and honest than it was back during the Superfish episode when it basically lied through its teeth until it couldn't lie any more.

Filed Under: bios, blocked, competition, linux, locked, secure boot, signature edition, windows
Companies: lenovo, microsoft

DRM: Still Hurting Paying Customers The Most

from the the-internet-is-for-opening-client-side-PDFs-apparently dept

Today's Stupid DRM Trick is brought to you by Adobe LiveCycle ES3 and Windows 10.

Starting in August, we started to receive noise from end-users on unable to open DRM protected PDFs, ones that are protected with 2016-17 policy, with the use of Adobe Reader and Adobe Acrobat. Users are mostly facing issue on seeing the below message when opening the PDFs:

Error Message:

"This computer must be connected to the Internet in order to open this document. Your permission to open this document offline has expired. Make sure this computer is connected to the network and the Adobe Experience Manager- Forms Server(Document Security) is running."

or

"This computer must be connected to the network in order to open this document. Your permission to open this document offline has expired. Make sure this computer is connected to the network and the Adobe LiveCycle Rights Management Server is running."

While I can understand some companies might want to prevent unauthorized users from reading PDFs possibly containing sensitive material, the fact that an authorized user's computer has to "phone home" to Adobe to read a PDF generated (and held) by a third party is ridiculous. While password-protection schemes may have their drawbacks, the LiveCycle solution doesn't do much for employees (or students -- LiveCycle is also used for courseware) who might not have access to an internet connection (an unfortunate reality when traveling) but still need access to these documents.

However, this problem isn't completely Adobe's fault (although the DRM's insistence on an internet connection still is). It appears a Windows update is what's preventing LiveCycle from phoning home.

Today, I am unable to access the pdf courseware on my system due to the following error message:

"This computer must be connected to the Internet in order to open this document. Your permission to open this document offline has expired. Make sure this computer is connected to the network and the Adobe Experience Manager- Forms Server(Document Security) is running."

Now, I know my system is connected to the network but I can't figure out what else is wrong. Usually, when I open these pdfs, I get a login prompt but this time, nothing. Please help ASAP. But even after re-downloading the material from aspen portal once again, it still doesn't work. I had installed the Cumulative Update for Windows 10 Version 1511 for x64-based Systems (KB3163018) on 30-06-2016 and the only issue I faced before was that the login prompt was not appearing but I could still open the document. Now, I can't even open the document.

Once again, a Windows update breaks something that was working, leaving end users to clean up the company's mess. Another user had the same update kill their VPN access. And if it's not blocking connections, it's killing webpages accessed through Microsoft's own Edge browser. Fun stuff. These not-all-that-optional cumulative updates tend to create as many problems as they solve and Microsoft's own "help" isn't all that helpful, leading to this sort of exasperated response.

The trouble we have is I have over 200 Windows 10 machines and cannot go to each one and run a tool to view the updates. We use WSUS and I had hoped that there would be a way to split out the Cumulative update so we can disable the two patches I mentioned and then have that push. I have for the time being approved the update for removal in WSUS so it will handle removing it. I am concerned about the other fixes and not having them. Does MSFT QA these updates or are they blaming Cisco on this one?

So, we have two issues, neither of them useful to end users. On Adobe's end, we have a protection scheme that requires an internet connection. That's classic DRM -- phone home, get permission… all well and good (NOT REALLY) until someone needs access to documents but can't because they're not connected to the internet.

Then we have an update that breaks the connection Adobe's DRM relies on, forcing the same problem on users who do have internet access. The problem with DRM schemes like these is that they rely on a bunch of parts that aren't interconnected (Adobe, Windows) but both have to be working properly to get the job done... rather than just, say, open Adobe Reader and be done with it. Subtract an internet connection and Adobe's documents are useless, even to authorized users. Throw a suprisingly volatile Windows update into the mix and end users doing everything right are still screwed. Combine the two and sensitive documents are suddenly so "protected" that a majority of users can't even view them. And, remember, this is a "privilege" corporate customers pay for.

DRM: still mostly useless and still mainly a pain in the ass for paying customers.

Filed Under: drm, livecycle es3, pdf, windows 10
Companies: adobe, microsoft

ACLU Challenges Gag Orders Issued To Tech Companies By The DOJ

from the hey,-we-notified-SOMEBODY...-that-counts-for-something dept

The ACLU is hoping to intervene in Microsoft's legal battle against the government, challenging gag orders attached to warrants and subpoenas issued under the Electronic Communications Privacy Act (ECPA). Microsoft sued the DOJ back in April, arguing for the right to notify customers that their communications and data have been handed over to the government.

Microsoft didn't have a problem with the government's gag orders in every case. It's just that the demand for secrecy accompanied more than half of the ~300 orders per month Microsoft receives. And nearly 70% of those gag orders arrived with no fixed end date.

The ACLU petitioned the court to intervene in the case on its own behalf, citing its position as a Microsoft customer. The DOJ filed a motion to dismiss Microsoft's lawsuit, hoping the court will find Microsoft has no standing to challenge gag orders on its customers' behalf. The ACLU is trying to prevent this from happening until the DOJ addresses the issues raised by the ACLU's (attempted) intervention. In its opposition [PDF] to the DOJ's motion, the ACLU points out that the government's "no standing" argument pretty much nullifies any sort of due process for Microsoft customers (including the ACLU) who've been targeted by the DOJ's super-secret warrants, relegating them to a Kafka-esque legal purgatory.

The government attempts to insulate its refusal to provide notice from judicial review, arguing that neither Microsoft nor the ACLU has standing to raise these important constitutional questions. By the government’s logic, Microsoft does not ever have standing to defend its customers’ right to notice, and Microsoft’s customers, including the ACLU, may not defend their own right to notice until after they receive the primary relief they would seek—that is, notice. In the government’s view, the only plaintiffs who have standing to sue for notice are those who have already gotten it, and those deprived of notice forever have no ability to seek a remedy at all. That is not the law.

The hope here is to not only find the open-ended gag orders unconstitutional, but also the law granting this secrecy -- the ECPA -- unconstitutional as well. The shift from physical "papers" to digital files was addressed by legislators in the worst way possible. The ECPA did away with the notification requirement attached to searches of physical places. When a home or business is searched, the owner or resident is served with a warrant. For electronic communications, a third party is approached. Legislators apparently felt as long as someone was notified, that was good enough -- even if that someone isn't the target of the search warrant.

That's basically the government's argument: notice is served to the site of intrusion. If the affected parties don't actually reside there (but their "papers" do), too bad.

The government’s argument conflates a historical anachronism with a constitutional principle. The government is correct that officers traditionally provided Fourth Amendment notice at the physical site of the intrusion. But that is so because, for the first 175 years of the Fourth Amendment’s application, it was understood to cover primarily physical trespasses. See Katz, 389 U.S. at 353. As a result, notice provided at the site of the intrusion was notice to the individual whose Fourth Amendment rights were at stake. It is no surprise, therefore, that Federal Rule of Criminal Procedure 41 reflects that historical context. Under Rule 41(f), an officer executing a warrant must “give a copy of the warrant and a receipt for the property taken to the person from whom, or from whose premises, the property was taken or leave a copy of the warrant and receipt at the place where the officer took the property.”

The ECPA is the DOJ's argument committed to paper. Notice only needs to be provided to the third party where communications and documents are held. To ensure the party whose documents/communications are being taken is kept out of the loop, the DOJ takes the wording of the law to heart and ignores the intent behind the Fourth Amendment protections granted to citizens.

The ECPA does not require the government to provide notice when it relies on a warrant, and so the government now routinely searches and seizes individuals’ electronic communications without providing any notice—delayed or otherwise—to those whose private information it has obtained. According to Microsoft’s Complaint, nearly half of the federal demands it has received under ECPA in the last eighteen months were accompanied by gag orders, the majority of which contained no time limit. Accordingly, a substantial portion of the individuals whose electronic communications the government demands from Microsoft receive no notice whatsoever, from either the government or Microsoft.

The law undercuts the Fourth Amendment by preventing those affected from challenging the lawfulness of the search or seeking redress through the judicial system for violations. Gag orders that run indefinitely allow the government to avoid being held accountable for any wrongdoing. In addition, the service of warrants to third parties is done without any meaningful oversight, putting the DOJ in the position of policing itself -- something it does with no particular enthusiasm or effectiveness.

Filed Under: doj, ecpa, gag order, standing, subpoena, surveillance, warrants
Companies: aclu, microsoft

The EFF Calls Out Microsoft's Ongoing Bullshit On Windows 10 Privacy Concerns

from the talking-out-of-both-sides-of-your-mouth dept

While Windows 10 is generally well-liked by reviewers and users, it's relatively clear that it's not the OS to choose if you actually want to control how much babbling your OS does over the network. While a lot of complaints about Windows 10 have been proven to be hyperbole or just plain wrong (like it delivers your BitTorrent behavior to Hollywood or it makes use of menacing keyloggers), Windows 10 is annoyingly chatty, sending numerous reports back to Microsoft even when the operating system is configured to be as quiet and private as possible.

While Microsoft has been criticized for this behavior for some time now, the general response out of Redmond has been to tap dance over, under and around most of the key complaints.

Enter the Electronic Frontier Foundation, which last week effectively called on Microsoft to stop bullshitting everybody in terms of what gets collected and why. The EFF does a good job reiterating how Microsoft used malware-esque tactics to get users to upgrade, then once installed, Windows 10 collects user location data, text input, voice input, touch input, web browsing history, and general computing telemetry data, including which programs you run and for how long -- which would be arguably less of an issue if you had full control over how much of this data was collected and funneled back to the Redmond mothership.

Microsoft has made some modest changes to address ballooning concern about user privacy over the last year, but the EFF notes that the company continues to tap dance around how much data is collected, what the company is doing with it, and why users can't have full privacy control over an OS they purportedly own:

A significant issue is the telemetry data the company receives. While Microsoft insists that it aggregates and anonymizes this data, it hasn’t explained just how it does so. Microsoft also won’t say how long this data is retained, instead providing only general timeframes. Worse yet, unless you’re an enterprise user, no matter what, you have to share at least some of this telemetry data with Microsoft and there’s no way to opt-out of it.

Microsoft has tried to argue that Windows Update won't work if telemetry reporting is minimized and user privacy and preferences are actually protected. In short, Microsoft has tried to claim that giving users broader control puts the user at risk by hamstringing security updates. That's something the EFF is quick to call bullshit on, calling it a "false choice" that's "entirely of Microsoft's own creation." What Microsoft should do if it truly values its customers, the EFF argues, is dramatically ramp up company transparency and finally offer a meaningful, simple opt-out functionality:

Microsoft should come clean with its user community. The company needs to acknowledge its missteps and offer real, meaningful opt-outs to the users who want them, preferably in a single unified screen. It also needs to be straightforward in separating security updates from operating system upgrades going forward, and not try to bypass user choice and privacy expectations.

In response to the EFF, Microsoft has continued to do what it has always done: pretending that nothing is wrong, customer control and privacy are the company's highest priorities, and these privacy concerns are overblown because, shucks, most people really like the OS:

Microsoft is committed to customer privacy and ensuring that customers have the information and tools they need to make informed decisions. We listened to feedback from our customers and evolved our approach to the upgrade process. Windows 10 continues to have the highest satisfaction of any version of Windows.

Granted that may say more about past interactions of Windows than of Windows 10. Even then, because people generally like the core OS experience Windows 10 offers doesn't magically dismantle concerns that Microsoft still, more than a year after launch, isn't actually listening to its customers when it comes to privacy and control.

Filed Under: privacy, windows 10
Companies: eff, microsoft