Facebook's Collection And Use Of Data From Third-Party Sources Is 'Abusive', Says Germany's Competition Authority

from the informational-self-determination dept

As Techdirt has reported previously, Facebook is having various problems in the European Union because of the region's privacy laws. It turns out that data protection is not the only area where it is coming under scrutiny. Germany's competition authority, the Bundeskartellamt, has just made a preliminary assessment that Facebook's data collection is "abusive":

the authority assumes that Facebook is dominant on the German market for social networks. The authority holds the view that Facebook is abusing this dominant position by making the use of its social network conditional on its being allowed to limitlessly amass every kind of data generated by using third-party websites and merge it with the user's Facebook account. These third-party sites include firstly services owned by Facebook such as WhatsApp or Instagram, and secondly websites and apps of other operators with embedded Facebook APIs.

This is not about privacy, then, but about Facebook's alleged abuse of its dominant position in the German market. The German competition authority is not worried about Facebook's use of personal data gathered directly on its own sites -- not yet, at least -- but the way in which data is transmitted back to Facebook from third-party sites, as a detailed background document (pdf) explains :

The current proceeding examines the terms and conditions Facebook is enforcing with regard to data from third party sources. These are on the one hand data generated by the use of services owned by Facebook, such as WhatsApp or Instagram, and on the other data generated by the use of third party websites and apps. If a third-party website has embedded Facebook products such as the 'like' button or a 'Facebook login' option or analytical services such as 'Facebook Analytics', data will be transmitted to Facebook via APIs the moment the user calls up that third party's website for the first time. These data can be merged with data from the user's Facebook account, even if the user has blocked web tracking in his browser or device settings. In the authority's preliminary assessment, Facebook's terms and conditions in this regard are neither justified under data protection principles nor are they appropriate under competition law standards

The detailed analysis from the German competition authority makes an interesting point about the nature of Facebook's business model, and the fact that its users have no choice about accepting its terms and conditions:

Facebook offers its service for free. Its users therefore do not suffer a direct financial loss from the fact that Facebook uses exploitative business terms. The damage for the users lies in a loss of control: they are no longer able to control how their personal data are used. Facebook's users are oblivious as to which data from which sources are being merged to develop a detailed profile of them and their online activities. On account of the merging of the data, individual data gain a significance the user cannot foresee. Because of Facebook's market power users have no option to avoid the merging of their data, either. Facebook's merging of the data thus also constitutes a violation of the users' constitutionally protected right to informational self-determination.

The competition authority's finding is preliminary: Facebook now has the opportunity "to comment on the allegations and provide justification for its conduct or offer possible solutions." The company has already responded with a blog post by Yvonne Cunnane, Head of Data Protection, Facebook Ireland, in which she writes:

Although Facebook is popular in Germany, we are not dominant. We're just one part of how people interact, and we must constantly innovate to ensure we're meeting people’s expectations -- from designing new features to improving reliability to giving people better controls over their experience on Facebook. If we fail, people will go elsewhere -- as history has shown with other technology services over the years.

This is a crucially important battle for Facebook. If the German competition authority issues a final ruling next year that Facebook is abusing its dominant position through its use of data from third parties, it could order the US company to cease aggregating data in this way. That would be a major blow to Facebook's current business model, in Europe at least, since it is likely that other competition authorities there would take the same line. Facebook derives much of its power as an advertising medium from the vast quantities of data gathered from all around the Web that it collects and uses for profiling.

As if Facebook did not have enough problems in the EU, France's data protection agency has just ordered WhatsApp to stop sharing user data with its parent company, or face fines. Although these would be small under current legislation, once the EU's new General Data Protection Regulation comes into force next year, they could be up to 4% of Facebook's global turnover.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: data, data collection, germany, privacy
Companies: facebook, instagram, whatsapp

WhatsApp Reportedly Rejected UK Government Demand For Encryption Backdoor

from the under-pressure dept

The UK government has apparently already asked WhatsApp to provide it with an encryption backdoor, according to Sky News. The app developers were told they needed to come up with a way to give law enforcement access to message content but WhatsApp politely declined the probably not-all-that-polite "request."

That doesn't mean WhatsApp doesn't have anything it can give the government when it comes asking.

Sky News understands that WhatsApp co-operates with law enforcement to provide the metadata it does hold - the name of an account, when it was created, the last seen date, the IP address and associated email address.

WhatsApp says it "appreciates the work that law enforcement agencies do to keep people safe around the world. We are prepared to carefully review, validate and respond to law enforcement requests based on applicable law and policy".

But it does point out it can't give law enforcement what it doesn't actually have.

[T]he company argues that it can't provide data that WhatsApp itself does not collect in the first place, including the contents of a message.

Encryption didn't seem to be much of an issue in many recent terrorist attacks, but its use is undoubtedly on the rise. It's unclear what the government showed or told Sky News, but this assertion seems dubious at best.

Sky News understands that 80% of investigations into terrorism and serious crime are now impacted by encryption.

As is the case over here, law enforcement officials are arguing WhatsApp and other encrypted message services should sacrifice user security for the good of the government. While cybersecurity experts continue to point out the nonexistence of backdoored-but-secure unicorns, intelligence officials continue to assert it can be done. All that needs to happen is for messaging services to make their products a little bit less safe.

UK intelligence officials believe a compromise could be possible - pointing out that cybersecurity isn't binary and that services offer different levels of cybersecurity to deal with different levels of threats.

WhatsApp is unlikely to budge on its backdoor rejection, leaving it with the real possibility of exiting the UK market if the government turns its requests into encryption-targeting law. And, as the UK goes, so goes Australia. The Australian government has been echoing the anti-encryption rumbling of Theresa May and other officials, indicating it too would like encrypted services to not be quite so encrypted.

It's not as though UK law enforcement/intelligence services don't have lawful options if WhatsApp refuses to budge. As cryptography expert Riana Pfefferkorn points out, there's more that can be done, even if it won't be as easy as firing off a warrant.

Riana Pfefferkorn, a cryptography policy fellow at Stanford University, said she sees a legal battle coming if the UK continues to force the issue, but she doesn't necessarily think the UK wants that fight.

If courts determine that the Investigatory Powers Act is too broad, the public defeat in their fight against encryption would be a lot for the UK to overcome. Instead, Pfefferkorn said the government might just try hacking for the information they want, a power that the IP Act also allows.

"There are other avenues they can take to try to achieve the same end," she said.

For now, WhatsApp message content is still out of reach of everyone but users engaged in conversation. Metadata and lawful hacking are still in play, even though most officials prefer an easier route. If pressure continues to mount, WhatsApp may exit markets rather than compromise its users. As much as intelligence officials may believe cybersecurity to be something other than "binary," the companies they're applying pressure to really only have two choices: give in to the government or exit market left. Neither are palatable options.

Filed Under: backdoors, communications, encryption, uk
Companies: whatsapp

Aussie Prime Minister Says The Laws Of Math Don't Apply In Australia When It Comes To Encryption

from the good-luck-with-that,-mate dept

Oh boy. It's no secret that the Australian government -- led by George Brandis (who has made it abundantly clear he has no clue what a VPN is or what metadata is) -- is pushing strongly for mandated backdoors to encryption. At this point, it's beating a dead horse, but this is a very, very bad idea for a whole host of reasons -- mainly having to do with making absolutely everyone significantly less safe.

And it appears that Brandis' ignorance has moved up the chain of command. Australian Prime Minister Malcolm Turnbull has now put out what may be the single dumbest statement on encryption yet (and that's a pretty high bar). After being told yet again that safe encryption backdoors violate basic mathematics, Turnbull became super patriotic about the ability of Australian law to trump mathematics:

"The laws of Australia prevail in Australia, I can assure you of that," he said on Friday. "The laws of mathematics are very commendable, but the only law that applies in Australia is the law of Australia."

And, then he pulled out the "nerd harder, nerds" argument:

"I'm not a cryptographer, but what we are seeking to do is to secure their assistance," Turnbull said. "They have to face up to their responsibility. They can't just, you know, wash their hands of it and say it's got nothing to do with them."

"I am sure they know morally they should. Morally they should."

So after admitting that he doesn't understand how this works, he's saying that the "moral" responsibility of cryptographers -- who have basically all told him his plan will make people less safe -- is to make people less safe.

Turnbull seems to think he can get around the whole problem by... semantics. You see, if we just redefine things and say we're not asking for "backdoors" then it's fine:

"A back door is typically a flaw in a software program that perhaps the -- you know, the developer of the software program is not aware of and that somebody who knows about it can exploit," he said. "And, you know, if there are flaws in software programs, obviously, that's why you get updates on your phone and your computer all the time."

"So we're not talking about that. We're talking about lawful access."

That bit of word salad suggests that at least a tiny smidgen of actual knowledge made it into his brain. A backdoor is an exploit. But "lawful access" is a backdoor. Pretending they are different suggests a fairly staggering level of ignorance.

Not to be outdone, but Brandis then took his own turn at the podium to spew more ignorance:

Asked how Australia's proposed regime would allow local authorities to read messages sent with either WhatsApp or Signal, Brandis said “Last Wednesday I met with the chief cryptographer at GCHQ ... And he assured me that this was feasible.”

Right. It's pretty well known that intelligence communities can frequently hack into things to get messages, but not because of backdoors to encryption but through other flaws. This includes things like keyloggers or other spyware that effective route around the encryption. But that's entirely different than demanding backdoors. And, of course, this all comes about a week after GCHQ's own former boss argued that attacking the end points was a better strategy than backdoors. It's almost certain that what GCHQ told Brandis is that they can be pretty successful in attacking those endpoints, without undermining encryption -- and that message got twisted in Brandis' mind to believe that it meant that there were already backdoors in Whatsapp and Signal (there are not).

This whole thing is a somewhat tragic comedy of errors with completely clueless politicians making policy badly, potentially putting everyone at risk... while astoundingly claiming that laws can trump basic mathematics. What a joke.

Filed Under: australia, encryption, gchq, george brandis, going dark, malcolm turnbull, math, nerd harder
Companies: signal, whatsapp

Theresa May Tries To Push Forward With Plans To Kill Encryption, While Her Party Plots Via Encrypted Whatsapp

from the so-about-that... dept

As we've discussed a few times, Theresa May and her colleagues have been pushing to break real encryption as part of the party's manifesto. And they've used recent terrorist attacks as an excuse to ramp up that effort -- even though the perpetrators of recent attacks were already known to law enforcement and there's no evidence encryption played any role. Earlier in the year, Home Secretary Amber Rudd had insisted that encrypted communications were completely unacceptable, and specifically namechecked Whatsapp:

It is completely unacceptable. There should be no place for terrorists to hide.

We need to make sure that organisations like WhatsApp, and there are plenty of others like that, don’t provide a secret place for terrorists to communicate with each other.

Of course, as you've certainly heard by now, last Thursday's general election in the UK (understatement alert!) didn't quite go according to Theresa May's plan, and she's now left in a much weaker position with many people expecting she will not survive long as Prime Minister. And yet, showing her uncanny ability to double down on the absolute wrong thing, May is insisting she's moving ahead with her plans to regulate the internet, which will require vast censorship and a breaking of encryption. On the encryption angle, she's already got some Parliamentary support given that (as we and others warned at the time!) the Snooper's Charter ("Investigatory Powers Act") included a bit that would require anyone offering encrypted communications to unencrypt those communications (which is impossible if the encryption is strong end-to-end, and only possible with broken, insecure, fake "encryption").

This is both dumb and... hilarious. Because while all of this is going on, Theresa May's own party has been trying to figure out what the hell they're going to do. And, of course, the way they're communicating with each other is with the encrypted Whatsapp software that Amber Rudd was trashing just months ago:

Former minister Ed Vaizey told the BBC that he supports May staying on, but that Tories were discussing possible replacements. Asked whether members were calling one another to plot May’s ouster this weekend, he denied it.

“That’s so 20th century,” he said. “It’s all on WhatsApp.”

Indeed, soon after this came out, one of the possible candidates to replace May, Boris Johnson, claimed that he was sticking by May and... released screenshots of his own Whatsapp conversations to prove that he was supporting her.

So, there you have it. Theresa May is pushing forward to break encrypted chat apps like Whatsapp, while her own party is using encrypted chat apps, like Whatsapp, to discuss whether or not to keep her in place as Prime Minister.

Filed Under: backdoors, boris johnson, encryption, privacy, theresa may, uk
Companies: whatsapp

Mounting Privacy Problems In Europe For Facebook's Acquisition Of WhatsApp

from the statement-of-objections dept

When it comes to online privacy, the European data protection authorities tend to be quite interventionist as they try to police the movement of personal data within and out of the EU. The concerns over the Safe Harbor and Privacy Shield frameworks are one manifestation of this. Another is the increasing EU scrutiny of Facebook's purchase of WhatsApp.

A couple of years after Facebook acquired WhatsApp, the latter announced that it was updating its terms and privacy policy so as to allow user data to be transferred to its parent company. Johannes Caspar, the Commissioner for Data Protection and Freedom of Information in Hamburg, where Facebook has its German headquarters, was unhappy with that move. He saw it as harmful to users' privacy, not least because there was no way to opt out of the data sharing. In September last year, he ordered Facebook to stop collecting data from WhatsApp, and to delete anything it had already brought across. Facebook appealed against the decision, and the Administrative Court of Hamburg has now handed down its ruling, which is to deny the US giant's request for Caspar's order to be revoked (pdf):

Facebook has appealed to the administrative court against the order in the preliminary proceedings. The goal was to repeal the immediate enforcement. The court rejected this request today and clarified the fact that it does not see any legal basis for the planned data exchange. Facebook can not invoke interests of its own business because the complete data exchange is neither necessary for the purpose of network security or business analysis nor for advertising optimization. Furthermore, the court clarifies that there is no effective consent from WhatsApp users for a data exchange with Facebook. As a result, the administrative court is making a clear consideration in the context of the preliminary legal proceedings: the interests of the approximately 35 million German WhatsApp users predominates the economic interest of Facebook in a suspension of immediate enforceability.

That's not the only problem Facebook faces in Europe. A little while after WhatsApp announced that it would be consolidating its user data with Facebook, the European Commission sent what is called a "Statement of Objections" to Facebook, alleging that:

the company provided incorrect or misleading information during the Commission's 2014 investigation under the EU Merger Regulation of Facebook's planned acquisition of WhatsApp.

The problem is that:

When reviewing Facebook's planned acquisition of WhatsApp, the Commission looked, among other elements, at the possibility of Facebook matching its users' accounts with WhatsApp users' accounts. In its notification of the transaction in August 2014 and in a reply to a request of information, Facebook indicated to the Commission that it would be unable to establish reliable automated matching between the two companies' user accounts.

Once WhatsApp and Facebook started carrying out precisely that kind of automated data matching last year, the Commission naturally wondered whether Facebook had been totally frank in its answers. The company had until January 31 to explain itself, and the Commission is now deciding whether it feels it was given misleading information. If it does, the consequences may be quite costly. Under EU law, Facebook could be fined 1% of its global turnover -- which would amount to around $179 million based on 2015 revenues. On its own, that probably wouldn't be too much of a problem for the deep-pocketed company. But combined with the ruling in Germany, and the possibility that data protection authorities in other countries will follow suit -- the law is the same throughout the EU, after all -- these European concerns about privacy are turning into a major a headache for Facebook.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: data protection, data sharing, eu, germany, privacy, privacy shield
Companies: facebook, whatsapp

UK Home Secretary: I Need People Who Understand The Necessary Hashtags To Censor Bad People Online

from the oh,-and-to-break-encryption-to dept

So, last week a clearly troubled individual by the name of Khalid Masood killed four people in Westminster and, as happens all too often after something bad happens, politicians went insane. But no one more so than UK Home Secretary Amber Rudd, who really maybe should have taken a moment or two to find out what the hell she was talking about before going on TV spouting off complete and utter nonsense about technology, social media and encryption. Instead, Rudd, who again, I remind you, is in a very powerful position within the British Cabinet (sort of loosely equivalent to the head of Homeland Security in the US) said this while talking about getting various social media companies to be more proactive in censoring content:

“What I’m saying is the best people who understand the technology, who understand the necessary hashtags to stop this stuff even being put up, not just taking it down, are going to be them. That’s why I would like to have an industry-wide board set up where they do it themselves.”

The best people... who understand the necessary hashtags. The. Necessary. Hashtags. Or should that be #NecessaryHashtags. I mean, that's so insane that it distracts from the fact that the UK Home Secretary is literally saying that she wants internet companies to come together in a mass collusion to censor content the UK Home Secretary doesn't like.

Believe it or not, that wasn't even the craziest thing that this person-in-power had to say. Prior to the #NecessaryHashtags, we were given a full throated UK-version of James Comey and his silly, debunked "going dark" nonsense, just with a British accent:

“It is completely unacceptable. There should be no place for terrorists to hide.

“We need to make sure that organisations like WhatsApp, and there are plenty of others like that, don’t provide a secret place for terrorists to communicate with each other.

“It used to be that people would steam open envelopes, or just listen in on phones, when they wanted to find out what people were doing, legally, through warrantry, but in this situation we need to make sure that our intelligences services have the ability to get into situations like encrypted WhatsApp.”

We don't necessarily (hashtag or not!) need to rehash just how wrong this is -- we've covered that plenty of times in the past. The fact is there are always going to be tons of places where "terrorists" can communicate with each other that no one can see. Sometimes it will be in person. Sometimes it will be in public, but using a pre-designated code. And, of course, even more importantly, this crazy decision to blame encrypted communications apps in a case where even Rudd admits the guy was a lone actor, completely ignores just how important encrypted, private communications are to the rest of us. It takes quite a misguided thought process to think "here we have a disturbed lone actor who did an attack, and therefore we need to make absolutely everyone else significantly less safe." It takes an even more misguided process to take that thought and go on TV and announce it as an official plan of the UK government.

Oh, and remember, this is the same UK government that just months ago got massive new powers to spy on the public.

If it's not yet obvious from what was said above that Rudd is just playing tech buzzword bingo and has simply no idea what she's talking about, she also said this:

“We’re not saying open up, we don’t want to go into the cloud, we don’t want to do all sorts of things like that, but we do want them to recognise they have a responsibility to engage with government, to engage with law enforcement agencies when there is a terrorist situation”.

You're not saying open up and you don't want to go into the cloud? But you are saying that encryption shouldn't be allowed to work? What is she even saying? This is all nonsense. The companies do engage with governments all the time. When given a valid and legal warrant, they do what they can. Sometimes that's nothing.

Of course, all of this is coming on the heels of another misguided outrage at other tech companies for sometimes allowing bad people to use their tools. Paul Bernal has an oasis of sanity responding to some of this cesspool of craziness.

Terrorists use the internet to communicate and to plan because we all use the internet to communicate and plan. Terrorists use the internet to access information because we all use the internet to access information. The internet is a communicative tool, so of course they’ll use it – and as it develops and becomes better at all these things, we’ll all be able to use it in this way. And this applies to all the tools on the net. Yes, terrorists will use Google. Yes, they’ll use Facebook too. And Twitter. And WhatsApp. Why? Because they’re useful tools, systems, platforms, whatever you want to call them – and because they’re what we all use. Just as we use hire cars and kitchen knives.

[....]

The same is true of privacy itself. We all need it. Undermining it – for example by building in backdoors to services like WhatsApp – undermines us all. Further, calls for mass surveillance damage us all – and attacks like that at Westminster absolutely do not help build the case for more of it. Precisely the opposite. To the surprise of no-one who works in privacy, it turns out that the attacker was already known to the authorities – so did not need to be found by mass surveillance. The same has been true of the perpetrators of all the major terrorist attacks in the West in recent years. The murderers of Lee Rigby. The Boston Bombers. The Charlie Hebdo shooters. The Sydney siege perpetrators. The Bataclan killers. None of these attacks needed identifying through mass surveillance. At a time when resources are short, to spend time, money, effort and expertise on mass surveillance rather than improving targeted intelligence, putting more human intelligence into place – more police, more investigators rather than more millions into the hands of IT contractors – is hard to defend.

Why is it that all the sane thoughts on this seem to be coming from outside the government, and the craziest ideas coming from those in the highest positions of power?

Filed Under: amber rudd, censorship, encryption, free speech, going dark, necessary hashtags
Companies: telegram, whatsapp, wordpress

WhatsApp And Its End-to-end Encryption Get Love From An Unusual Quarter: International Diplomats

from the pass-it-on dept

Encryption remains a hot issue, with politicians repeatedly claiming that it allows bad people to hide bad things, although there isn't much evidence this is really a problem. More recently, WhatsApp has become a favorite target since it introduced end-to-end encryption that allegedly not even the company can decrypt. David Cameron vaguely threatened to block it, and Brazil actually tried. Against that background, the following story from the Guardian offers a welcome contrast of government officials using -- and loving -- WhatsApp, not least for its end-to-end encryption:

The rise of WhatsApp diplomacy is transforming the negotiating chamber. There are countless groups of allies and virtual huddles, exchanges over policy statements and fine print, and fair amounts of banter and even emojis (Vladimir Putin is referred to by widespread use of a grey alien avatar).

"You can form small groups of like-minded allies, take photos of annotated documents, ask people what they think without the whole room knowing," a senior western diplomat said.

The tool is useful for communicating with allies who might not be sitting close to them, diplomats say, as well as for agreeing negotiating tactics during difficult sessions and for organising break-out huddles in a way that avoids offending those left out.

The article goes on to describe some real-life situations in which WhatsApp chats offered a vital channel during diplomatic negotiations. It also notes some of the ways the app is being used, for example to make discreet requests like "please speak at the plenary in support of x" or "let's meet outside to discuss this," and the rather more dramatic "please interrupt this person."

This isn't the first hint that WhatsApp is becoming an important tool for international diplomacy. Back in May of this year, a Guardian news item about an internal report into the problems within the UK's Foreign Office included the following information:

The report also finds that rather than make use of specially-tailored encryption, many British diplomats reportedly use WhatsApp to discuss sensitive topics such as the bloody conflicts in Syria and Ukraine.

The author of the report, Tom Fletcher, a former British ambassador to Lebanon, is also quoted in the latest WhatsApp story, where he says:

The smartphone is now as essential a part of the modern diplomat's armoury as courage, patience and a strong stomach. But it is also a threat to the diplomat -- heaven forbid that leaders should start WhatsApping each other direct, without needing to go through their diplomatic envoys.

That's one potential problem with the new WhatsApp diplomacy. Another is that diplomats may start to depend on the app, and take its security for granted. But as Techdirt reported back in April, WhatsApp's end-to-end encryption is not quite as secure as people might think. Moreover, if the program became the de facto tool for communicating among diplomats, a great deal of important information would be passing through it that many governments would dearly love to know. If that happens, the pressure on WhatsApp to provide backdoors to allow the authorities to eavesdrop on those conversations will become even greater. It would be relatively easy to do that: the app is not open source, so there's no way to check. Let's hope that diplomats are beginning to understand why that would be such a bad idea, and will add their voice opposing any such short-sighted moves.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: communications, diplomats, encryption
Companies: whatsapp

Privacy Groups File FTC Complaint Over Whatsapp Facebook Privacy 'Bait And Switch'

from the privacy-schmivacy dept

When popular messaging app Whatsapp was acquired by Facebook in 2014 for $19 billion, the company responded to the obvious privacy implications with a blog post promising to "set the record straight" about the acquisition, while debunking all of the "inaccurate and careless information" being circulated online. In it, co-founder Jan Koum promised that the app, which has tried to build a reputation on respecting user privacy, would keep privacy at the heart of its operations under Facebook. Privacy was, Koum promised, simply "coded into our DNA":

"Respect for your privacy is coded into our DNA, and we built WhatsApp around the goal of knowing as little about you as possible: You don't have to give us your name and we don't ask for your email address. We don’t know your birthday. We don’t know your home address. We don’t know where you work. We don’t know your likes, what you search for on the internet or collect your GPS location. None of that data has ever been collected and stored by WhatsApp, and we really have no plans to change that."

That was then, this is now.

Last week, the company announced in a new blog post that it would soon begin sharing Whatsapp user phone numbers and various analytics data with Facebook. While this is obviously about money, the company's blog post repeatedly insisted the move was about helping the end user avoid spam and make stronger, deeper connections with friends:

"But by coordinating more with Facebook, we'll be able to do things like track basic metrics about how often people use our services and better fight spam on WhatsApp. And by connecting your phone number with Facebook's systems, Facebook can offer better friend suggestions and show you more relevant ads if you have an account with them. For example, you might see an ad from a company you already work with, rather than one from someone you've never heard of."

Gosh, thanks. The Electronic Privacy Information Center was quick to claim that Facebook and Whatsapp may have violated federal law with the move. The group notes it filed an FTC complaint back in 2014 (pdf) expressing concern that failure to obtain users' opt-in consent before modifying privacy practices was an "unfair and deceptive trade practice" violating Facebook’s FTC Consent Order (pdf). In a subsequent letter from the FTC to Whatsapp (pdf), the FTC warned the two companies that they must honor their privacy promises to WhatsApp users.

As expected, EPIC and the Center for Digital Democracy have filed a formal complaint with the FTC (pdf), accusing Facebook of violating Section 5 of the Federal Trade Commission Act. In public statements, both organizations accuse Facebook and Whatsapp of a "bait and switch" on previous promises that user information would not be used for marketing across the Facebook social media empire:

"The FTC has an obligation to protect WhatsApp users. Their personal information should not be incorporated into Facebook’s sophisticated data driven marketing business,” said Katharina Kopp, Ph.D., and CDD’s Director of Policy. “Data that was collected under clear rules should not be used in violation of the privacy promises that WhatsApp made. That is a significant change that requires an opt-in, according to the terms the FTC set out. It’s not complicated. If WhatsApp wants to transfer user data to Facebook, it has to obtain the user’s affirmative consent."

Whatsapp users looking to opt out of data collection within the 30 day warning window simply have to uncheck the "share my account info" box before accepting WhatsApp's newly updated terms and conditions. Users who accidentally approved the new TOS still have several weeks to uncheck this same box by clicking on "settings," "account," then unchecking the same "share my account info" box. Granted the Whatsapp opt out instructions note that even after doing this you're still not entirely opted out of having this data shared with the "Facebook family of companies":

"The Facebook family of companies will still receive and use this information for other purposes such as improving infrastructure and delivery systems, understanding how our services or theirs are used, securing systems, and fighting spam, abuse, or infringement activities."

It seems unlikely that the EPIC and CDD complaints gain much traction. Fortunately, unlike sectors like telecom, users here aren't stuck waiting on regulators since they already have the choice of alternative, open source (and frankly already more secure) encrypted messaging options.

Filed Under: encryption, messaging, privacy
Companies: facebook, whatsapp

Literal Fashion Police Arrest Hundreds Of WhatsApp And Instagram Users In Iran

from the seems-reasonable dept

I'll admit I've had some fun in these pages with my friends over in the Iran over the years. In my defense, they have at times made the job quite easy for me, between trying to bolster their military reputation through video game footage, trying to suggest that the West carve out a non-free speech zone when it comes to criticizing Islam or members of its faith, and the country's policy of futility in trying to block its citizens from using the wider internet. These are actions worth criticism and scorn.

But things got a just a bit more dangerous for some in Iran this past week, as the country has announced it is cracking down on its citizens for actions against Islam and for infractions of fashion on display on several social media services. It seems some portion of the Revolutionary Guard has quite literally become the Fashion Police.

Iran has arrested or summoned about 450 social media users, a website linked to the Revolutionary Guards has reported. Users of apps such as Instagram, Telegram and WhatsApp have been targeted.

"These people were carrying out immoral activities, insulted religious beliefs or had illegal activities in the field of fashion," the Gherdab website said.

Details in the report or scant, but it's likely that those that have partaken in criminal fashion activities are undoubtedly female, and the criminal activity almost certainly involves perceived infractions against modesty that are taken so seriously in Islamic theocracies. This should provide a wonderful example of the benefits of secularism over theocracy, certainly, but it should also serve as a beacon of hope for change in a country run in the most unfortunate of fashions. Although, that previous statement comes along with the caveat that even the founders of secularism can manage an insane over-correction, such as what's currently going on along the beaches of Southern France, for example.

If we've learned anything over recent years, it's that demand for internet access and the ability for expression on its mediums will only grow, not shrink. And, if citizens of countries less free than others are bucking the rules, routing around the censorship and barriers to internet access, and partaking in expression so yearned for but considered illegal, no amount of claimed providence will keep those young men and, more importantly women, from growing up and changing their society to match their values.

Facebook and Twitter are banned in the Islamic republic, though software that provides access is easily available. More than half of Iran's 80 million population is online.

That's a good thing.

Not so good is potentially the fate of those caught in the current crackdown. Still, there is a reason that Iran makes such an effort of blocking its citizens from joining the rest of the networked world, and seeing so many of them streaming around the borders of the barriers means there is hope.

Filed Under: fashion police, iran, social media
Companies: instagram, telegram, whatsapp

This Is What It Was Like To Take Part In The Failed Turkish Coup, In The Words Of The Plotters

from the history-in-the-making dept

A year ago, we wrote about an interesting new organisation called Bellingcat. Although it's not clear what kind of project it should be called, it's easy to understand what it does: it takes publicly-available information from many sources, and tries to piece together the jigsaw puzzle of contemporary events. Its most recent analysis is an extremely topical piece of work:

A group of plotters of the failed Turkish coup attempt used a WhatsApp group to communicate with each other. Bellingcat has transcribed, translated, and analysed the conversation, thereby cross-referencing the messages with photos, videos, and news reports of the evening, night, and morning of July 15-16.

There are two sources for the WhatsApp conversation. One was widely circulated on Twitter soon after the coup, and consists of a video purporting to show messages on the phone of a plotter. The other source is a series of photos obtained by a journalist with Al Jazeera, although no further information on them is given. Naturally, claims that these are authentic need to be treated with caution, and this is where the Bellingcat method of drawing on diverse sources shows its strength. For example, a mention of the 66th Mechanised Infantry Brigade in the conversation is corroborated using other information from Twitter, Facebook and YouTube as follows:

By cross-referencing registration plates, military vehicles of the 2nd Armoured Brigade and the 66th Mechanised Infantry Brigade can indeed be spotted on photographs taken during the coup attempt in Istanbul. Number plates from vehicles from the First Army all start with "1" followed by five other numbers, thus "1XX XXX". While some military vehicles had their number plates covered during the coup attempt, others had not and often showed registration plates starting with "117" and "196", as Twitter users @Ald_Aba and @AbraxasSpa noted.

These numbers can be specifically attributed to the 2nd and 66th regiments, by looking at older photo and video material of both units, @Ald_Aba tweeted. As with regards to the numbers "196", photos uploaded to Facebook of the 2nd Armoured Brigade also show vehicles with the number "196". Similarly, the numbers "117" we also spotted on a vehicle of a YouTube video of the 66th Mechanised Infantry Brigade.

The extensive Bellingcat post consists of the conversation, in the original and in translation, as well as commentary of the kind quoted above. It provides extraordinary insights into the mechanics of a coup in the digital age.

At first, everything seems to be going according to plan, as key Turkish infrastructure is seized, including the state broadcaster. At around about midnight local time, one of the plotters in the WhatsApp group warns: "Privately owned TV stations must be silenced." But shortly afterwards, Turkey's President Erdoğan made his by-now famous speech using FaceTime while mid-flight, broadcast by the privately-owned TV stations the plotters had failed to shut down. The Bellingcat post explains:

President Erdoğan's speech is not mentioned in the group conversation, but the direct results of that speech are clearly noticeable: most units are asking for support as they are being surrounded by large crowd of civilians.

As a result, the plotters give increasingly desperate orders to use lethal force on the growing crowds, but to no avail. The last part of the WhatsApp transcription records the guttering of the short-lived attempted coup:

"Has the operation been cancelled Murat", Major Aygar asks.
"Yes, commander", he replies.
Major Aygar: "We're quitting??"
Colonel Doğan: "Which operation, all of it?"
Major Çelebioğlu: "Yes quit, commander."
Colonel Doğan: "Meaning?"
Major Çelebioğlu: "Yes, commander, operation aborted."
Colonel Doğan: "Shall we escape?"
Major Çelebioğlu: "Stay alive, commander. The choice is yours. We have not decided yet. But we have left our position. I'm closing the group. Delete the messages if you want."

It's fortunate for us -- and for future academics who will pore over them -- that the messages were not completely deleted. They survive to provide us with a unique record of a coup as it happened, told in the words of those who tried and failed to seize a major nation. On their own, the short bursts of conversation would be interesting, but hard to parse. With Bellingcat's characteristic annotations and amplifications, they become a gripping spectacle of history as it was being made, just two weeks ago.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: coup, discussion, plots, turkey
Companies: bellingcat, whatsapp