As Some Are Requiring People To Give Up Their Info To Dine, Stories Of Creeps Abusing That Info Come Out

from the the-privacy-conundrum dept

I think many of us are going to avoid eating at sit-down restaurants for the foreseeable future, even if governments deem them to be "safe." However, I find it at least somewhat unnerving to see Governor Jay Inslee in Washington say that in order for a restaurant to offer dine-in services, it will need to keep a log of all diners for 30 days, including their telephone and email contact info.

Under Gov. Jay Inslee's new statewide orders, Washington restaurants that offer sit-down service will be required to create a daily log of all customers.

The restaurants must maintain that log for 30 days, including telephone and email contact information and the time they were in the restaurant. The state wants this information to facilitate any contact tracing that might need to occur.

I fully understand why this requirement is there. Since contact tracing is so important, it's much more difficult to do contact tracing in situations like these where there's no way to tell who else was in the same small space where a COVID-positive person dined. But... at the same time, it seems to raise a number of privacy questions.

When I tweeted about this, some pushed back and said it wasn't much different from ordering online or from an app (or even, potentially, paying with a credit card). All of those give up some level of privacy. Yet, as I've been saying for years, privacy is about trade-offs and a big part of that is understanding the benefits and the risks. And when we're ordering with an app or using a credit card, there are reasonable systems in place that make it unlikely that your info will be abused. These are not perfect, and there are some cases where there are risks. But, for most people, the "threat model" suggests it's not that risky.

Yet, it's unclear if that's the case with something like a "restaurant log," like the one that Washington State is requiring. As an example of why that might be problematic, we can just head down to New Zealand (which appears to have almost entirely contained COVID-19) to hear of a story about a restaurant worker using the contact tracing info a customer left to hit on her:

"I had to put my details on their contact tracing form which I didn't think anything of. It asked for my name, home address, email address and phone number so I put all those details down," she tells Newshub.

Except in Jess's case she didn't just take away a sandwich from the Subway restaurant she was at. She also got a Facebook request, Instagram request, Facebook messenger approach and a text from the guy who served her, using her contact tracing details.

"I felt pretty gross, he made me feel really uncomfortable," she says.

"He's contacting me, I didn't ask him to do that, I don't want that.

"I'm lucky that I live with quite a few people because if that was me by myself at home - he knows my address you know - I'd feel really, really scared. Even now I feel a bit creeped out and vulnerable."

The article does note that the Subway employee who did that digital stalking "has now been suspended" (is that New Zealand for fired?), but it can't make anyone very comfortable.

And that's a much bigger issue than just for that woman. If people are afraid that their private info can be misused, they're less likely to give it. In other words, the nature of the privacy trade-offs are vastly different than they might otherwise be. Not understanding that leads to bad results, and yet that seems to be what's happening in Washington.

After receiving some pushback, Inslee is now saying that the logs should only be kept for 14 days and that privacy "protocols" are developed. But that's the kind of thing that need to be built up initially, not after such a plan is announced:

“This is something that we have to make sure that we build protocols around privacy so that any of this information can only be used for this purpose, can be expunged after 14 days so that this is only a minor inconvenience. No one is looking to make this a federal crime. We’re trying to save some lives here,” Inslee added.

Again, he means well, and there's obvious value in contact tracing done correctly. But you can't ignore the privacy issues, and you can't tack them on after things are already messed up. Any system needs to develop the concept with privacy built in from the very start -- and there's no indication that Washington state has done so.

Update: Late this evening Governor Inslee announced that this would no longer be a requirement, though suggested that restaurants set up a voluntary system. It appears he listened to some of the criticism.

Filed Under: contact tracing, dining, pandemic, privacy, restaurants, tradeoffs, washington

Washington State Legislators Pass Bill Blocking Use Of Facial Recognition Tech Without A Warrant

from the over-the-sobbing-of-law-enforcement-agencies dept

We all like a good facial recognition ban, and the state of Washington is the latest to (sort of) tee one up.

The Washington state legislature passed a bill establishing new guardrails on government use of facial recognition software.

The bill cleared both chambers of the state legislature Thursday, hours before the session ended, positioning Washington as one of the first states in the nation to regulate facial recognition, a key component in the larger legal debate over artificial intelligence. The bill now awaits Gov. Jay Inslee’s signature.

Unfortunately, it's not a true ban. But it lays down a set of guidelines that will at least control its use by state agencies. The bill [PDF] requires regular reporting on use and intermittent testing for "fairness and accuracy." It also introduces something most states haven't: a warrant requirement for facial recognition use. This means facial recognition tech can't be an "always on" option for law enforcement.

The bill recognizes the threat facial recognition tech poses to the public.

Unconstrained use of facial recognition services by state and local government agencies poses broad social ramifications that should be considered and addressed. Accordingly, legislation is required to establish safeguards that will allow state and local government agencies to use facial recognition services in a manner that benefits society while prohibiting uses that threaten our democratic freedoms and put our civil liberties at risk.

It also mandates the development of data retention policies and the implementation of reporting and controls of other, non-state agency use of facial recognition tech owned by state entities. State agencies are also required to deliver the equivalent of Privacy Impact Assessments for any tech deployed.

A description of any potential impacts of the facial recognition service on civil rights and liberties, including potential impacts to privacy and potential disparate impacts on marginalized communities, and the specific steps the agency will take to mitigate the potential impacts and prevent unauthorized use of the facial recognition service.

While an outright ban (or at least a moratorium) would have been preferable, this is a positive development. It shows legislators recognize the multiple issues this tech poses and its tendency to exacerbate existing inequality problems by being seemingly incapable of accurately identifying anything other than white males.

If this bill becomes law, Washington will join a handful of cities (and one state!) around the country taking measures to protect residents from unproven tech that is swiftly becoming ubiquitous. Facial recognition tech is no longer the latest "rule of law" darling. It's increasingly being viewed as a threat to civil liberties -- not just by privacy advocates/activists, but by the people who actually can prevent their constituents from the steady creep of government surveillance.

Filed Under: 4th amendment, facial recognition, law enforcement, warrants, washington

Washington And Oregon Fine CenturyLink For Completely Bogus Broadband Fees

from the gullibility-surcharge dept

For decades, broadband providers have abused the lack of meaningful competition in the telecom market by not only refusing to shore up historically awful customer service, but by raising rates hand over fist. This usually involves leaving the advertised price largely the same, but pummeling customers with all manner of misleading fees and surcharges that drive up the actual price you'll be paying each month. And by and large regulators from both major political parties have been perfectly okay with this practice, despite it effectively being false advertising.

CenturyLink (combined by the merger of Qwest, CenturyTel and Embarq) has been exceptionally talented when it comes to such fees. A few years ago the company began charging its broadband customers an "Internet Cost Recovery Fee," which the company's website explains as such:

"This fee helps defray costs associated with building and maintaining CenturyLink's High-Speed Internet broadband network, as well as the costs of expanding network capacity to support the continued increase in customers' average broadband consumption."

But the cost of maintaining broadband networks is what your entire bill is supposed to be for. Again, breaking out such additional bullshit surcharges and burying them below the line is designed to do one thing: help providers falsely advertise a lower rate. And while the "internet cost recovery fee" was only a few bucks per month, it's a fairly lucrative scam when spread across millions of CenturyLink's US broadband subscribers over the last five years.

With the federal government now largely comatose on such issues, states have been forced to step up to the plate and try to fill the void. As a result, Centurylink was forced to settle a lawsuit by Oregon's AG requiring it cease the practice and shell out $4 million to impacted consumers. That settlement comes several weeks after a similar settlement with Washington State's AG to the tune of $6.1 million:

"CenturyLink deceived consumers by telling them they would pay one price, and then charging them more,” Ferguson said. “Companies must clearly disclose all added fees and charges to Washingtonians. If you believe that a company has charged dishonest fees, please contact my office.”

In states where telecom regulatory capture is more prevalent (read: most of them), absolutely nothing is being done to thwart this practice, which extends to other fees like the misleadingly named "regulatory recovery surcharge" or the widespread "local sports surcharge" and $10 per month "broadcast TV" fees.

Keep in mind, these are precisely the kind of consumer enforcement actions the Trump FCC attempted to ban with its net neutrality repeal, which didn't just repeal net neutrality but attempted to neuter nearly all state and federal oversight of one of the least-liked and uncompetitive industries in America. The courts argued the FCC overreached, noting it can't eradicate its telecom protection authority, then try to ban states from stepping in to fill the void. The fact they even attempted the gambit should tell you all you need to know about the Ajit Pai FCC.

Filed Under: bogus fees, broadband, competition, consumer protection, extra fees, ftc, hidden fees, oregon, truth in advertising, washington
Companies: centurylink

Comcast Gets $9 Million Fine For Tricking Customers With 'Worthless' Protection Plans

from the relative-wrist-slap dept

In August of 2016, Washington State sued Comcast, claiming the cable giant had long been offering consumers a "service protection plan" that was barely worth the paper it was printed on. According to the Washington State AG, the plan promised consumers "comprehensive" protection for all repairs, service calls, maintenance of inside wiring and customer-owned equipment, and "on-site education about Comcast products" for $5 more per month.

But the AG investigation found Comcast repeatedly misled consumers about the scope of the plan, and routinely charging consumers for repairs and service that should have been included under the plan's umbrella. Comcast misled more than 500,000 Washington state consumers in this fashion, and the AG's original lawsuit (pdf) noted that Comcast had even created a clear "service code" for techs to use when they wanted to incur charges for service that should have been covered under the plan.

Fast forward to last week, when a ruling in King County, Washington court (pdf) found that Comcast also technically violated the law more than 445,000 times when it charged tens of thousands of Washingtonians for this worthless Service Protection Plan -- without first obtaining their consent. From the full AG announcement:

"The court found that Comcast added the SPP to the accounts of 30,946 Washingtonians without their knowledge, and did not tell an additional 18,660 Washingtonians the true cost of the plan. The court ordered Comcast to refund affected consumers, and pay 12 percent interest on the restitution. The amount of restitution is unknown at this time, but is expected to be significant. The court ordered Comcast to issue the refunds within 60 days and report to the state on the specific details and amounts."

Comcast's little gambit was certainly profitable: the court ruling declared that Comcast netted more than $73 million in errant fees over a five-year period by signing up customers for the worthless service plan they never asked for. Court recordings even documented how Comcast would sign up customers for the plan even when they clearly rejected Comcast representatives' pitches.

Comcast, whose historically terrible customer service is already the stuff of legend, will be required to refund nearly 50,000 customers and pay a $9.1 million fine to make up for years of misleading behavior. And while that sets a Washington State record, that still likely falls well short of the total net profit Comcast made from scamming Washington State consumers. And that's of course just Washington State; if Comcast was doing this in Washington, it was likely doing it in other states, yet no other states have pursued investigations into the behavior.

In the wake of the federal government abdicating most of its authority to protect consumers from giant telecom monopolies that face little organic competition, states have tried to step up their game when it comes to consumer protection. But it hasn't been easy; with the Ajit Pai FCC's help, the telecom lobby has tried its damnedest to ban states from being able to hold giant ISPs responsible. That gambit hasn't been working out all that well -- at least in states that can be bothered to actually still care about consumer protection.

Filed Under: fcc, scams, service protection plan, washington, wireless protection plan
Companies: comcast

Washington State Supreme Court Tries, Fails To Protect The Rights Of The State's Residents

from the no-points-for-effort dept

A correct conclusion was almost reached by the Washington Supreme Court… but it was foiled by the fact that only eight justices reviewed the case. Here's the backstory to the decision that almost was, via Nick Sibilla of Forbes.

The case began more than three years ago in Shoreline, Washington when a late-night shouting match between Solomon McLemore and his girlfriend prompted a bystander to dial 911. When the officers arrived and repeatedly demanded to be let in, the yelling stopped though no one answered the door. After 15 minutes and still no response, police heard glass shattering and, suspecting domestic violence, began forcing their way inside. As the officers broke down the door, McLemore told police that they were infringing on his rights and that they needed a warrant. Officers also heard McLemore tell his girlfriend to tell police that she was ok.

Once inside, police determined that the woman was not injured and promptly threw McLemore in handcuffs. But McLemore wasn’t charged for domestic violence. Instead, police arrested McLemore for “obstructing a law enforcement officer,” which involves “willfully hinder[ing], delay[ing], or obstruct[ing] any law enforcement officer in the discharge of his or her official powers or duties.” For refusing to open his door to police, McLemore was convicted for obstruction and sentenced to 20 days of house arrest.

The issue before the court should have been a foregone conclusion, but the court's headcount helped prevent that from happening.

Here's the question: is a citizen obligated to grant the government access to their residence in the absence of warrant? The answer should obviously be, "No." It certainly shouldn't be obstruction charges. It's not that there aren't exceptions to the warrant requirement. It's whether or not citizens have a legal duty to assist officers with their warrantless entry.

The officers definitely had a legitimate exception at their disposal. A report of possible domestic violence gives officers all the permission they need for a warrantless entry under the community caretaking function. Entering the apartment to ensure any possible victims weren't in need of medical care or other assistance is justifiable. McLemore, however, refused to allow the officers to enter without a warrant.

But a valid warrant exception doesn't automatically place a burden on homeowners to allow officers inside. McLemore's refusal to open the door and, once officers were inside, refuse to help officers sort out the domestic situation shouldn't be a crime. That was the conclusion originally reached by the nominal "majority" of the split court [PDF].

Criminalizing the refusal to open one's own door to a warrantless entry would be enormously chilling and inconsistent with our deeply held constitutional values.

[...]

Even under the more limited protections afforded by the Fourth Amendment than our own constitution, "[w]hen law enforcement officers who are not armed with a warrant knock on a door, they do no more than any private citizen might do. And whether the person who knocks on the door and requests the opportunity to speak is a police officer or a private citizen, the occupant has no obligation to open the door or to speak."

[...]

Under the limited construction of the statute required by our constitution, a defendant's conduct that amounts to passive delay will not sustain an obstruction charge.

That was the correct conclusion to reach. It would have brought the state in line with the rest of the country. As the ACLU noted in its amicus brief, Washington is the only place where "an individual can be convicted for peacefully refusing a warrantless home intrusion."

Less than a day after the court had decided to join the other 49 states in decriminalizing non-criminal behavior, the court recounted its votes and decided the tie was actually a loss for state residents.

It is hereby ordered that that the lead opinion of Gonzalez, J., filed April 18, 2019, in the above entitled case is changed as indicated below.

On page 17, line 2 of the slip opinion, beginning with "We", strike all material down to and including "opinion." on line 3 and insert:

We in the lead opinion would hold the city presented insufficient evidence to sustain McLemore's conviction and remand to the trial court for further proceedings consistent with this opinion. However, we recognize this opinion has garnered only four signatures. "Therefore, there being no majority for the reversal of the judgment of the trial court, it necessarily stands affirmed, and the order of this court is that the judgment appealed from be and it is hereby affirmed." Peterson v. City of Tacoma. 139 Wash. 313, 313, 246 P. 944 (1926).

Thanks to this reversal of its own reversal, cops can continue to arrest people for exercising their rights. That's no way to run a judiciary. Equally concerning is the fact that four justices apparently decided the lousy status quo wasn't worth upending. A reversion to an "enormously chilling" standard shouldn't be an acceptable conclusion, but that's all Washington residents have left until this is appealed to the highest court in the nation.

Filed Under: 4th amendment, obstruction, solomon mclemore, warrant, washington

Washington Prison Management Software Setting People Free Too Early, Keeping Other People Locked Up Too Long

from the on-average,-it-works dept

All this technology is getting in the way of justice being served. For the second time in five years, Washington's Department of Corrections is dealing with issues created by its prisoner management software. Four years ago, this happened:

For three years, state Department of Corrections staff knew a software-coding error was miscalculating prison sentences and allowing inmates to be released early. On Tuesday, Gov. Jay Inslee gave the damning tally: up to 3,200 prisoners set free too soon since 2002.

For thirteen years, officials knew there was a problem with the software but did nothing about it. It wasn't until the state's governor got involved that anyone at the DOC started caring about its malfunctioning code. The code was supposedly fixed but new problems arose, affecting both sides of the jail walls.

A software problem has caused at least a dozen Washington prison inmates to be released too early — or held too long — and has sparked a review of as many as 3,500 cases.

Department of Corrections (DOC) officials are scrambling to determine whether the other inmates’ sentences were miscalculated and are still working to gauge the scope of the problem.

The previous bug miscalculated "good time" credits, resulting in thousands of premature releases. This time around, buggy code is screwing up calculations for inmates who have violated their parole. A few have benefited from the problem. But most of the cases being reviewed involve inmates who have been jailed for too long.

The previous calculation error resulted in two homicides by an inmate who was released too early. This time around, it's far more likely inmates who have served their time aren't being released. Either way, there's life and liberty on the line and the Department of Corrections is showing little sense of urgency when addressing these problems.

If there's a silver lining, it's this: with enough votes, the state's convoluted sentencing laws will be simplified, potentially making the calculation of sentences easy enough any human can do it.

[State Representative Roger] Goodman has proposed legislation, House Bill 1495, creating an 18-member task force that would review and recommend simplifications to the state’s sentencing guidelines, with a final report due by the end of 2020. He said his committee also may ask DOC leaders for a public briefing and explanation of the latest sentence-calculation problems.

Of course, this could take as long to fix as it took the state DOC to fix its original software problem. No answers would be expected for another 18 months, by which point new bugs in the DOC's software may surface and start handing out get out of jail free cards to some inmates and go directly to jail cards to others who've already served their time.

And if it's not working now, there's a good chance the DOC's software will never function properly. Part of the problem is the legislature itself, which complicates sentence calculations by adding new wrinkles with each legislative session. According to the Seattle Times, at least 60 bills in the pipeline could affect sentencing guidelines, increasing the chance of new calculation errors developing.

Software may be the only way to handle a job this complex. But those overseeing the software's deployment have shown they're not too interested in proactive maintenance of this complex system. Problems are eventually solved, years after the fact. That sort of responsiveness is unacceptable when guidelines are being constantly altered by new legislation.

Filed Under: department of corrections, inmates, mistakes, prison management, software, washington