EFF Highlights How ISPs Are Lying To Californians To Try And Kill New Broadband Privacy Protections

from the trust-us,-we're-the-phone-company dept

When AT&T, Verizon and Comcast convinced lawmakers to kill broadband consumer privacy rules earlier this year, everybody in this chain of campaign-cash dysfunction got notably more than they bargained for. As with net neutrality, the relatively-modest privacy protections had broad bipartisan consumer support (our collective disdain for Comcast magically bridges the partisan divide). As a result, when the FCC's rules died, more than a dozen states rushed in to craft their own privacy rules that largely mirror the discarded FCC protections.

And while that creates the problem of multiple, potentially discordant (or just plain bad) state laws, that's probably something the broadband industry should have thought about before paying Congress to axe the FCC's privacy rules.

Obviously worried that states would step up and protect consumers where the FCC will not, ISP allies like Marsha Blackburn quickly got to work trying to pass new federal regulation that pretends to address privacy concerns, but is being designed primarily to pre-empt state efforts on this front. FCC boss Ajit Pai, who has previously defended protectionist ISP-written state laws as a "states rights" issue, suddenly turned on a dime here, stating he would be exploring ways to use FCC authority to keep states from protecting consumer privacy in the wake of repealing the FCC's privacy rules.

In California, Assemblyman Ed Chau introduced AB 375 (pdf) earlier this year. AB 375 mirrors the FCC proposal in that it requires that ISPs transparently disclose what private data is being collected and sold, while requiring ISPs provide working opt out tools. In some ways it goes further than the FCC's proposal, in that it specifically bans ISPs from charging broadband subscribers more money to protect their privacy -- something both AT&T and Comcast have flirted with. Needless to say, large ISP lobbyists are desperate to prevent this law from taking root.

The EFF has been documenting this week all of the misleading claims being made by ISP lobbyists as they attempt to scuttle the legislation. The ISPs, with their rich history of violating consumer trust on this subject, are telling the California legislature that privacy protections aren't necessary because ISPs have done nothing wrong. That ignores how Verizon was caught covertly modifying packets to track users around the internet, how ISPs have hijacked search queries for financial gain, how AT&T and Comcast made efforts to charge more for privacy, and how ISPs made efforts to use credit data to offer lower quality customer service to less affluent customers.

Again, these behaviors are all symptoms of a broader disease that nobody in either political party really wants to fix for fear of upsetting powerful campaign contributors: a lack of broadband competition. And while these regulatory patches certainly aren't ideal, until we actually decide to do something about a lack of competition -- these protections are/were the only thing standing between your family and Comcast's ability to nickel and dime the living hell out of you in a rotating array of creative new ways.

The EFF notes that in addition to ignoring obvious, documented history (not even mentioning AT&T's cozy relationship with the NSA), AT&T lobbyists are also pushing the narrative that the state law isn't necessary because FTC authority over broadband providers is plenty good enough moving forward:

"To California’s Legislature, AT&T right now is saying the following:

"AT&T and other major Internet service providers have committed to legally enforceable Privacy Principles that are consistent with the privacy framework developed by the FTC over the past twenty years."

In essence, there is no need to pass a state law because the Federal Trade Commission can enforce the law on us.

But we've noted already how AT&T lawyers are currently suing the FTC to try and ensure the agency has no authority over AT&T businesses whatsoever. We've also noted how this is all part of an ISP lobbying plan to gut FCC authority over broadband providers by rolling back Title II (net neutrality being just a small part of this), then shovel all remaining authority to an FTC that lacks the resources, authority, or funding to police duopoly ISP behavior. The goal is really quite simple: little to no actual oversight of some of the least competitive and least-liked companies in America.

And, as the death of privacy and looming death of net neutrality rules can attest, so far this plan is going swimmingly for ISPs. Except for the dozen or so states actually interested in standing up for their citizens' privacy rights.

While the EFF had previously warned that killing the FCC rules would cause a wave of less-ideal state-level laws, they're supporting AB 375 as they feel it's a good template for other states to follow for some consistency on this front:

"EFF supports states responding to the demands of the public for privacy protections, particularly in light of Congress having failed to do so. It has become even more important as the Federal Communications Commission itself is actively undermining consumer protections on behalf of Comcast, AT&T, and Verizon. It should surprise no one that state legislators who care about consumer privacy will act and ultimately having as many state laws on the books as possible to protect personal information is a superior outcome to having no clear protections at all.

And if A.B. 375 becomes law, we hope it would serve as the model for states across the country to avoid a patchwork problem, but again this problem was created by the ISP lobby repealing the federal rules in the first place."

So far ISP efforts to derail California's proposal (including having former FTC boss Jon Leibowitz pen misleading op/eds lobbying for ISPs against privacy protections) have seen mixed results, with the bill passing the first of several hurdles in the California legislature earlier this week. But again, California's fight is far from over. And it's just a microcosm of ISP attempts to remove already fairly-tepid oversight of the telecom sector, under the pretense that zero accountability for uncompetitive duopolists like AT&T and Comcast somehow magically results in connectivity Utopia.

Filed Under: broadband, california, competition, fcc, ftc, privacy
Companies: at&t, comcast, verizon

Private Data Of 6 Million Verizon Users Left Openly Accessible On The Internet

from the Whoops-a-Daisy dept

Yet another company has been caught leaving personal customer data just sitting on an openly-accessible server for anybody to obtain and abuse. According to Upguard and security researcher Chris Vickery, the data was being stored by Nice Systems, a Ra'anana, Israel-based company employed by Verizon to store and analyze the data for an "unknown purpose." The data, left unprotected on an Amazon S3 storage server by the company, included information on six million subscribers that had called Verizon support in the last six months, including customer names, phone numbers and the account pins used to access their accounts.

Vickery notes that the ability to abuse these pin numbers was particularly problematic:

"Beyond the risks of exposed names, addresses, and account information being made accessible via the S3 bucket’s URL, the exposure of Verizon account PIN codes used to verify customers, listed alongside their associated phone numbers, is particularly concerning. Possession of these account PIN codes could allow scammers to successfully pose as customers in calls to Verizon, enabling them to gain access to accounts—an especially threatening prospect, given the increasing reliance upon mobile communications for purposes of two-factor authentication."

Similarly problematic was the fact that Verizon and Nice were notified of the breach on June 13th, but the data wasn't secured until June 22:

"This exposure is a potent example of the risks of third-party vendors handling sensitive data. The long duration of time between the initial June 13th notification to Verizon by UpGuard of this data exposure, and the ultimate closure of the breach on June 22nd, is troubling. Third-party vendor risk is business risk; sharing access to sensitive business data does not offload this risk, but merely extends it to the contracted partner, enabling cloud leaks to stretch across several continents and involve multiple enterprises."

For its part, Verizon tried to downplay the breach to ZDNet, laying the entirety of the blame on Nice while trying to insist that most of the data had no real value:

"Verizon provided the vendor with certain data to perform this work and authorized the vendor to set up AWS storage as part of this project," said a spokesperson. "Unfortunately, the vendor's employee incorrectly set their AWS storage to allow external access."...The phone giant said that the "overwhelming majority of information in the data set has no external value."

Yeah, not comforting. The timing is ironic given that Verizon was one of several ISPs that just got done lobbying Congress and the Trump administration to kill new FCC broadband privacy protections that would have taken effect back in March. Those rules (pdf) would have not only required that ISPs be transparent about what third party data vendors obtain and store customer information, but required ISPs adhere to basic private data storage and protection standards, and quickly notify subscribers when their data is exposed (impacted users in this instance do not appear to have been notified yet).

Verizon had long argued that telecom privacy protections aren't necessary because the industry could "self regulate," something quickly disproven when Verizon was busted a few years ago covertly modifying wireless user data packets to track their behavior around the internet. At one point the company insisted that privacy protections aren't necessary because "public shame," would keep the company honest -- something that's a bit difficult when customers have absolutely no idea who's collecting, reviewing, or storing (poorly) their personal information in the first place.

Filed Under: chris vickery, data, security
Companies: nice systems, verizon

Verizon Bucks AT&T And Comcast, Supports Utility Pole Reform For Faster Fiber Deployment

from the bureaucratic-bumbling dept

In addition to high costs and the slow pace of digging up streets, one of the reasons Google Fiber is contemplating a pivot from fiber to next-gen wireless broadband is the boring old utility pole. As it stands now, new market competitors often have to navigate an archaic, elaborate and expensive process to attach fiber to poles. Quite often, attaching fiber requires having any other ISPs in the area notified in writing, then waiting for each one to move their own equipment piecemeal, one of several bureaucratic processes incumbents have long abused to slow down the arrival of new competitors.

When Google Fiber began more seriously deploying fiber, it proposed new "one touch make ready rules" in many municipalities. Under these revised rules, a licensed, insured third-party contractor is allowed to move any equipment on utility poles with owner approval. In many instances, these contractors are the very same ones used by large ISPs themselves. The regulatory reform is estimated to streamline the pole attachment process by six months to a year.

But because this regulatory reform would make it easier for broadband competitors to come to market, large ISPs like AT&T, Comcast and Charter (Spectrum) decided to sue cities like Louisville and Nashville for proposing such reforms. Of course these regional mono/duopolies can't admit they're predominately motivated by anti-competitive reasons, so they've tried to argue they're simply worried that the reform will cause rampant outages (again, these are licensed, insured contractors already employed by many ISPs). Charter even tried to claim the reforms violated its First Amendment rights.

But something shifted this week in this long-standing, if under-noticed and important debate. Verizon has decided to buck AT&T and Comcast, and has published a blog post throwing its full-throated support behind Google's one touch utility pole reform (though you'll note they're careful not to mention their arch-nemisis Google by name). Verizon is quick to highlight the often-absurd bureaucracy at the heart of this process:

Under the current system, a new attacher must contact a pole owner to get permission to attach, wait for a survey, and then, wait some more as each existing attacher moves or adjusts their attachments – a process called “make-ready” (literally, making-the-pole-ready for the new attachment). Right now, this often proceeds sequentially, with multiple reviews and truck rolls for each of the providers already attached to the pole. It can take six months to a year – and piles of paperwork – to get a new attachment approved and placed on a pole.

Having deployed $25 billion or so in fiber to the home, the company proceeds to note that it, if anyone, should know a little something about this process. As such, it notes that a streamlined pole attachment process would bring a lot of efficiency to the entire affair, helping to speed up broadband deployment nationwide:

Instead of the current ungainly process, there would be one truck roll to make all of the adjustments to existing attachments and to add the new attachment. Just one disruption to traffic instead of multiple trucks. And to care for legitimate concerns about protecting networks and ensuring safety, the FCC could limit participation to qualified, licensed contractors who are approved by pole-owners, agree to abide by all applicable safety standards, and who, along with the new attacher, will indemnify pole owners and existing attachers if things go wrong.

The question of the hour is: why isn't Verizon siding with AT&T, Comcast and Charter out of a desire to protect itself from added fixed-line broadband competition? Verizon no longer cares about fixed-line broadband competition. As we've long noted, Verizon's FiOS expansion is all but frozen, and it's been selling off its unwanted fixed-line customers and networks piecemeal. Verizon's plan now is to gobble up AOL and Yahoo, and become an advertising and media company like Google -- but one that controls the conduit and the message via its nationwide wireless network.

And most of the current hotbeds for fiber deployment (pretty much everywhere but Verizon's territory in the Northeast) won't impact Verizon's remaining fixed-line infrastructure. But these fiber deployments outside of Verizon's territory will help fuel Verizon's fifth-generation (5G) expansion plans, which is why, for once, Verizon is actually on the right side of the issues -- instead of trying to keep the bureaucratic status quo intact.

Filed Under: broadband, fcc, one touch make ready, otmr, pole attachments
Companies: at&t, comcast, verizon

Charter, Verizon Flirt With Merger, Because Who Likes Broadband Competition Anyway?

from the look-at-all-the-synergies dept

Back in January, Wall Street chatter started to suggest that with Trump being much more friendly to M&As, some previously-unthinkable mergers were in store for the already uncompetitive telecom market. The most commonly discussed is a new merger between T-Mobile and Sprint (regulators blocked the first attempt in 2014 because it would have dramatically reduced competition). But another major rumor involves Verizon acquiring either Comcast or Charter Communications, something that Verizon executives have publicly tried to downplay, but evidence suggests remains high on the company's agenda all the same.

In fact, a report last week indicates that Charter has already turned down Verizon's initial offer. The offer -- valued at between $350 and $400 a share and well over $100 billion total -- wasn't quite high enough for Charter's liking, according to insiders familiar with the proposal:

The offer — valued at between $350 and $400 a share, and well over $100 billion, according to two of the sources familiar with the move — was rejected by Charter because it was too low — and because Charter and its largest shareholder, Liberty Media, weren’t ready to sell...Also standing in the way of Liberty Media agreeing to a deal for any of its units is the tax implications, which would be unpalatable to its billionaire chairman John Malone, sources said.

And part of the reason it's "unpalatable" right now is that the dust still hasn't settled from the telecom industry's last horrible merger, Charter's $79 billion acquisition of Time Warner Cable and Bright House Networks, approved under the Obama administration. That deal resulted in frozen speed upgrades, significantly higher prices and somehow even worse customer service. The end result has been a tidal wave of complaints about the new Spectrum company from consumers across newspapers nationwide, most of them now realizing that, for consumers, such deal "synergies" are often a step backwards.

Verizon's no stranger to deal dysfunction either, having recently struggled to finalize its Yahoo acquisition after it was revealed the company had numerous hacking intrusions it failed to tell Verizon about during negotiations. And the company's sale of its unwanted DSL customers in California, Texas and Florida was an absolute, indisputable shit show as the acquiring company, Frontier Communications, repeatedly highlighted it couldn't handle the massive influx of unwanted, mostly rural, broadband subscribers. It's also now drowning in debt, with bankruptcy on the lips of many investors.

So why would Verizon, a company with its own mounting debt, already looking to exit the fixed-line broadband business, suddenly want to acquire a cable company? It's believed that Verizon's primarily interested in Charter's fixed-line transit and other core infrastructure as a way to beef up its fifth-generation (5G) wireless ambitions. Of course like all such deals, there's the added benefit of eliminating a direct competitor in the television and broadband space, reducing the already skimpy competitive options already available in the consumer broadband market.

Filed Under: broadband, competiton, mergers
Companies: charter, verizon

Some Of The Best Net Neutrality Reporting Is... Coming From Sites Owned By Verizon?

from the well,-that's-cool... dept

You may remember, a few years ago, Verizon attempted to start its own tech blog, called "SugarString," where the founding editor they hired was telling potential reporters they couldn't write about net neutrality. After that got mocked around the web, the whole idea of SugarString faded away. However, these days, Verizon actually owns a ton of content sites. It bought AOL in 2015, which already owned the Huffington Post, Techcrunch, Engadget and more. More recently, of course, it bought Yahoo as well. Suddenly, Verizon owns a ton of tech reporting.

And here's the amazing thing: some of the best reporting about how awful Ajit Pai's net neutrality proposal is... is coming from those sites now owned by Verizon. For example, over at Yahoo News, Rob Pegoraro has been doing a great job debunking many of Ajit Pai's claims about the history of the internet. In particular, Pai and his supporters keep insisting that the move by then FCC boss Tom Wheeler in 2015 to reclassify broadband under Title II upset a consensus going back to the Bill Clinton years that broadband was not under Title II. Except that's... just wrong:

Pai led off with a dubious recap of history. In his telling, broadband thrived from the passage of the Telecommunications Act of 1996 until Pai's predecessor, former FCC chair Tom Wheeler, forced through today's net-neutrality rules that subject internet providers to phone-company "common carrier" regulations dating back to the 1930s that require the equal treatment of customers' traffic.

"Two years ago, the federal government's approach suddenly changed," Pai said. "The FCC, on a party-line vote, decided to impose a set of heavy-handed regulations upon the internet."

But as the FCC's own site shows, the commission didn't reclassify cable providers to lift them out of the common-carrier bucket until March 14, 2002, not 1996.

That's when the commission reclassified cable providers from open-ended "telecommunications services" to "information services" — a term that as, described in the 1996 law, better fits proprietary online services like floppy-disk-era AOL.

The commission didn't extend the same treatment to phone-based providers until 2005.

There's a lot more in that piece as well, correcting the blatant factual errors in Ajit Pai's claims about net neutrality.

Of course, you might claim that Verizon just purchased Yahoo, so perhaps word had not yet filtered down. But let's shift over to TechCrunch, which has been on the AOL banner for years, and the Verizon/AOL banner for quite some time as well. Over there, a reporter by the name of Devin Coldewey has written a series of truly excellent articles about the FCC's plans to roll back net neutrality. Those pieces are thorough, detail-oriented and not prone to the sorts of hyperbole that (unfortunately) have been seen on both sides of the net neutrality debate. For example, look at his article from last week that carefully goes through the arguments against net neutrality that people are making, and then carefully debunks each one. The piece is so damn good, I wish we ran it ourselves. For example, here's just one of the eight separate arguments that he debunks:

We’re not trying to remove net neutrality rules, just Title II

TL;DR: Removing the rules is literally in the proposal

It is frequently said that the point is not to remove the rules themselves, just change the authority to something a little less heavy-handed.

This is a puzzling assertion to make when the proposal itself asks over and over again whether the “bright line” rules of no blocking, no throttling, etc should be removed. It’s pretty clear that proponents don’t think the rules are necessary and will eliminate them if they can. Just because they frame their preference in the form of a question doesn’t make it any less obvious.

A sort of corollary to this argument is that internet providers will voluntarily adhere to suggested practices. This is a pretty laughable suggestion, and even if it were true, it self-destructs: if companies have no problem subjecting themselves to these restrictions, how can they be as onerous as they say?

Then, this week, once the rules were actually released, Coldewey absolutely destroys the key argument that Ajit Pai's FCC is making about the rules, noting that it appears to be a deliberate misrepresentation of how the internet works:

The first point the FCC makes is regarding the text of the 1996 Telecommunications Act, and how it defines “telecommunications service” (how broadband is currently defined, allowing net neutrality rules to be effected) and “information service” (how it was before the net neutrality rule).

Now, I’m going to list the two definitions. Which one do you think sounds like what a broadband provider does?

1. “The offering of a capability for generating, acquiring, storing, transforming, processing, retrieving, utilizing, or making available information via telecommunications, and includes electronic publishing, but does not include any use of any such capability for the management, control, or operation of a telecommunications system.”
2. “The transmission, between or among points specified by the user, of information of the user’s choosing, without change in the form or content of the information as sent and received.”

Take your time.

...

Okay. Number 2, right? Because your ISP doesn’t store the data you post on Facebook, or the address you look up on Google Maps, or the Pope you read about on Wikipedia. It’s edge providers like the ones I just mentioned that do all the “generating, acquiring, storing,” and so on. ISPs just transmit the information, don’t they?

Perhaps it would surprise you, then, to hear that the FCC has the exact opposite idea of how the internet works!

This is good stuff. Thorough, careful, and detailed facts that totally undermine Ajit Pai and the FCC's arguments. And it's coming from a site owned by Verizon. Now, obviously, the good news out of this is that it appears that Verizon is not interfering with editorial on these sites. That's actually encouraging (though I do wonder if the company will push to have "the other side" heard on these sites as well). Honestly, though, the links above are to three of the best pieces I've seen on net neutrality and how the arguments being made by Ajit Pai are either faulty, bogus or, at the very least, misrepresent reality. It's just icing on the cake that they happen to be on sites owned by Verizon, a company that has been at the center of the fight to kill net neutrality, and even had to drum up a fake journalist to talk to one of its execs, who insisted that the company really loved net neutrality (note: it does not).

Filed Under: devin coldewey, fcc, net neutrality, reporting, rob pegoraro
Companies: aol, verizon, yahoo

Apple, Verizon Join Forces To Lobby Against New York's 'Right To Repair' Law

from the making-ownership-more-expensive dept

Over the last year, we've noted the surge in so-called "right to repair" laws, which would make it easier for consumers to repair their electronics and find replacement parts and tools. It's a direct response to the rising attempts by companies like John Deere, Apple, Microsoft and Sony to monopolize repair, hamstringing consumer rights over products consumers think they own, while driving up the cost of said product ownership. John Deere's draconian lockdown on its tractor firmware is a large part of the reason these efforts have gained steam over the last few months in states like Nebraska.

In New York, one of the first attempts at such a law (the "Fair Repair Act") has finally been making progress. But according to New York State's Joint Commission on Public Ethics, Apple, Verizon, Toyota, Lexmark, Caterpillar, Asurion, and Medtronic have all been busy lobbying to kill the law for various, but ultimately similar, reasons. And they're out-spending the consumer advocates and repair shops pushing for this legislation by a rather wide margin:

"The records show that companies and organizations lobbying against right to repair legislation spent $366,634 to retain lobbyists in the state between January and April of this year. Thus far, the Digital Right to Repair Coalition—which is generally made up of independent repair shops with several employees—is the only organization publicly lobbying for the legislation. It has spent $5,042 on the effort, according to the records."

To be clear, the vast majority of the time, companies lobbying against this kind of legislation don't like to even admit that they oppose it. But when they do go on the record, it usually features a trifecta of false claims that the bills will make users less safe, pose a cybersecurity risk, and open the door to cybersecurity theft. In Nebraska, for example, we've already noted how Apple claims that allowing people to repair and tinker with the hardware they own will somehow turn the state into a "mecca for bad actors and hackers," and that letting consumers repair their own electronics would cause lithium batteries to catch fire.

Of course, the real reason Apple opposes this legislation is that it stands to lose significant repair revenue once people no longer have to drive half an hour to the nearest Apple Genius bar and support team. The same is true for game console makers Sony and Microsoft, who obviously would prefer it if you're only able to use their significantly-more expensive repair programs. They'll ignore the fact that this kind of behavior not only allows companies to charge an arm and a leg for what very well may be superficial repairs, but helps prop up closed, proprietary ecosystems, hurting customers in a myriad of other ways as well.

And while supporters of these right to repair bills are very candid about the benefits they think users will see, it's telling that the companies lobbying against these rules refuse to comment whatsoever on their opposition, and when they are willing to talk can only trot out a parade of theoretical horribles that don't really make coherent sense.

Filed Under: license agreements, new york, ownership, right to repair
Companies: apple, lexmark, toyota, verizon

AT&T, Comcast & Verizon Pretend They Didn't Just Pay Congress To Sell You Out On Privacy

from the trust-is-more-than-just-a-five-letter-word dept

Large ISPs like AT&T, Verizon and Comcast spent a significant part of Friday trying to convince the press and public that they didn't just screw consumers over on privacy (if you've been napping: they did). With the vote on killing FCC broadband privacy protections barely in the books, ISP lobbyists and lawyers penned a number of editorials and blog posts breathlessly professing their tireless dedication to privacy, and insisting that worries about the rules' repeal are little more than "misinformation."

All of these posts, in lock step, tried to effectively make three key arguments: that the FTC will rush in to protect consumers in the wake of the FCC rules being repealed (not happening), ISPs don't really collect much data on you anyway (patently untrue), and that ISPs' lengthy, existing privacy policies and history of consumer respect mean consumers have nothing to worry about (feel free to pause here and laugh).

For more than a decade, large ISPs have used deep-packet inspection, search engine redirection and clickstream data collection to build detailed user profiles, and their longstanding refusal to candidly talk about many of these programs should make their actual dedication to user privacy abundantly clear. Yet over at Comcast, Deputy General Counsel & Chief Privacy Officer Gerard Lewis spent some time complaining that consumer privacy concerns are little more than "misleading talk" and "misinformation and inaccurate statements":

"There has been a lot of misleading talk about how the congressional action this week to overturn the regulatory overreach of the prior FCC will now permit us to sell sensitive customer data without customers’ knowledge or consent. This is just not true. In fact, we have committed not to share our customers’ sensitive information (such as banking, children’s, and health information), unless we first obtain their affirmative, opt-in consent."

So one, the "commitment" Comcast links to in this paragraph is little more than a cross-industry, toothless and voluntary self-regulatory regime that means just a fraction more than nothing at all. And while Comcast insists it doesn't sell its broadband customers' "individual web browsing history" (yet), they do still collect an ocean of other data for use in targeted ads, and there's really little stopping them from using your browsing history in this same way down the road -- it may not be "selling" your data, but it is using it to let advertisers target you. Comcast proceeds to say it's updating its privacy policy in the wake of the changes -- as if such an action (since these policies are drafted entirely to protect the ISP, not the consumer) means anything at all.

Like Comcast, Verizon's blog post on the subject amusingly acts as if the company's privacy policy actually protects you, not Verizon:

"Verizon is fully committed to the privacy of our customers. We value the trust our customers have in us so protecting the privacy of customer information is a core priority for us. Verizon’s privacy policy clearly lays out what we do and don’t do as well as the choices customers can make."

Feel better? That's the same company, we'll note, that was caught covertly modifying user data packets to track users around the internet regardless of any other data collected. That program was in place for two years before security researchers even noticed it existed. It took another six months of public shaming before the company even provided the option for consumers to opt out. Verizon's own recent history makes it clear its respect for consumer privacy is skin deep. And again, there's nothing really stopping Verizon from expanding this data collection and sales down the road, and burying it on page 117 of its privacy policy.

AT&T was a bit more verbose in a post over at the AT&T policy blog, where again it trots out this idea that existing FTC oversight is somehow good enough:

"The reality is that the FCC’s new broadband privacy rules had not yet even taken effect. And no one is saying there shouldn’t be any rules. Supporters of this action all agree that the rescinded FCC rules should be replaced by a return to the long-standing Federal Trade Commission approach. But in today’s overheated political dialogue, it is not surprising that some folks are ignoring the facts."

So again, the FTC doesn't really have much authority over broadband, and AT&T forgets to mention that its lawyers have found ways to wiggle around what little authority the agency does have via common carrier exemptions. And while AT&T insists that "no one is saying there shouldn't be any rules," its lobbyists are working tirelessly to accomplish precisely that by gutting both FTC and FCC oversight of the telecom sector. Not partially. Entirely. Title II, net neutrality, privacy -- AT&T wants it all gone. Its pretense to the contrary is laughable.

Like the other two providers, AT&T trots out this idea that the FCC's rules weren't fair because they didn't also apply to "edge" companies like Facebook or Google (which actually are more fully regulated by the FTC). That's a flimsy point also pushed by an AT&T and US Telecom Op/Ed over at Axios, where the lobbying group's CEO Jonathan Spalter tries to argue that consumers shouldn't worry about ISPs, because their data is also being hoovered up further down the supply chain:

"Your browser history is already being aggregated and sold to advertising networks—by virtually every site you visit on the internet. Consumers' browsing history is bought and sold across massive online advertising networks every day. This is the reason so many popular online destinations and services are "free." And, it's why the ads you see on your favorite sites—large and small—always seem so relevant to what you've recently been shopping for online. Of note, internet service providers are relative bit players in the $83 billion digital ad market, which made singling them out for heavier regulations so suspect."

Again, this quite intentionally ignores the fact that whereas you can choose to not use Facebook or Gmail, a lack of competition means you're stuck with your broadband provider. As such, arguing that "everybody else is busy collecting your data" isn't much of an argument, especially when "everybody else" is having their behaviors checked by competitive pressure to offer a better product. As well-respected security expert Bruce Schneier points out in a blog post, these companies desperately want you to ignore this one, central, undeniable truth:

"When markets work well, different companies compete on price and features, and society collectively rewards better products by purchasing them. This mechanism fails if there is no competition, or if rival companies choose not to compete on a particular feature. It fails when customers are unable to switch to competitors. And it fails when what companies do remains secret.

Unlike service providers like Google and Facebook, telecom companies are infrastructure that requires government involvement and regulation. The practical impossibility of consumers learning the extent of surveillance by their Internet service providers, combined with the difficulty of switching them, means that the decision about whether to be spied on should be with the consumer and not a telecom giant. That this new bill reverses that is both wrong and harmful."

This lack of competition didn't just magically happen. As in other sectors driven by legacy turf protectors, the same ISP lobbyists that just gutted the FCC's privacy rules have a long and proud history of dismantling competitive threats at every conceivable opportunity, then paying legislators to look the other way. That includes pushing for protectionist state laws preventing towns and cities from doing much of anything about it. It's not clear who these ISPs thought they were speaking to in these editorials, but it's certainly not to folks that have actually paid attention to their behavior over the last fifteen years.

The EFF, meanwhile, concisely calls these ISPs' sudden and breathless dedication to privacy nonsense:

"There is a lot to say about the nonsense they've produced here," said Ernesto Falcon, legislative counsel at EFF. "There is little reason to believe they will not start using personal data they've been legally barred from using and selling to bidders without our consent now. The law will soon be tilted in their favor to do it."

Gosh, who to believe? Actual experts on subjects like security or privacy, or one of the more dishonest and anti-competitive business sectors in American industry? All told, you can expect these ISPs to remain on their best behavior for a short while for appearances' sake (and because AT&T wants its Time Warner merger approved) -- but it's not going to be long before they rush to abuse the lack of oversight their campaign contributions just successfully created. Anybody believing otherwise simply hasn't been paying attention to the laundry list of idiotic ISP actions that drove the FCC to try and pass the now-dismantled rules in the first place.

Filed Under: broadband, congress, fcc, ftc, lobbying, politics, privacy
Companies: at&t, comcast, verizon

AT&T, Verizon Feign Ethical Outrage, Pile On Google's 'Extremist' Ad Woes

from the manufactured-outrage dept

So you may have noticed that Google has been caught up in a bit of a stink in the UK over the company's YouTube ads being presented near "extremist" content. The fracas began after a report by the Times pointed out that advertisements for a rotating crop of brands were appearing next to videos uploaded to YouTube by a variety of hateful extremists. It didn't take long for the UK government -- and a number of companies including McDonald's, BBC, Channel 4, and Lloyd's -- to engage in some extended pearl-clutching, proclaiming they'd be suspending their ad buys until Google resolved the issue.

Of course, much like the conversation surrounding "fake news," most of the news coverage was bizarrely superficial and frequently teetering toward the naive. Most outlets were quick to malign Google for purposely letting extremist content get posted, ignoring the fact that the sheer volume of video content uploaded to YouTube on a daily basis makes hateful-idiot policing a Sisyphean task. Most of the reports also severely understate the complexity of modern internet advertising, where real-time bidding and programmatic placement means companies may not always know what brand ads show up where, or when.

Regardless, Google wound up issuing a mea culpa stating they'd try to do a better job at keeping ads for the McRib sandwich far away from hateful idiocy:

"We know advertisers don't want their ads next to content that doesn’t align with their values. So starting today, we’re taking a tougher stance on hateful, offensive and derogatory content. This includes removing ads more effectively from content that is attacking or harassing people based on their race, religion, gender or similar categories. This change will enable us to take action, where appropriate, on a larger set of ads and sites."

As we've noted countless times, policing hate speech is a complicated subject, where the well-intentioned often stumble down the rabbit hole into hysteria and overreach. Amusingly though, AT&T and Verizon -- two U.S. brands not exactly synonymous with ethical behavior -- were quick to take advantage of the situation, issuing statements that they too were simply outraged -- and would be pulling their advertising from some Google properties post haste. This resulted in a large number of websites regurgitating said outrage with a decidedly straight face:

"We are deeply concerned that our ads may have appeared alongside YouTube content promoting terrorism and hate," an AT&T spokesperson told Business Insider in a written statement. "Until Google can ensure this won’t happen again, we are removing our ads from Google’s non-search platforms."

"Once we were notified that our ads were appearing on non-sanctioned websites, we took immediate action to suspend this type of ad placement and launched an investigation," a Verizon spokesperson told Business Insider. "We are working with all of our digital advertising partners to understand the weak links so we can prevent this from happening in the future."

Of course, if you know the history of either company, you should find this pearl-clutching a little entertaining. In just the last few years, AT&T has been busted for turning a blind eye to drug dealer directory assistance scams, ripping off programs for the hearing impaired, defrauding government programs designed to shore up low-income connectivity, and actively helping "crammers" by making scam charges on consumer bills harder to detect. Verizon, recently busted for covertly spying on internet users and defrauding cities via bogus broadband deployment promises isn't a whole lot better.

That's not to say that all of the companies involved in the Google fracas are engaged in superficial posturing for competitive advantage. Nor is it to say that Google can't do more to police the global hatred brigades. But as somebody who has spent twenty years writing about these two companies specifically, the idea that either gives much of a shit about their ads showing up next to hateful ignoramuses is laughable. And it was bizarre to see an ocean of news outlets just skip over the fact that both companies are pushing hard into advertising themselves with completed or looming acquisitions of Time Warner, AOL and Yahoo.

Again, policing hateful idiocy is absolutely important. But overreach historically doesn't serve anybody. And neither does pretentious face fanning by companies looking to use the resulting hysteria to competitive advantage.

Filed Under: ads, extremism, moral panic, pearl clutching, search, video
Companies: at&t, google, verizon, youtube