FBI Director: We Need More Data On Police Shootings So Law Enforcement Can 'Change The Narrative'

from the it's-not-about-accountability,-it's-about-control dept

FBI Director James Comey didn't dig into his bag of "Ferguson Effect" rhetorical devices during his comments to a law enforcement conference on Sunday, but he came close. Under that theory, the possibility of being held accountable by citizens and their recording devices has apparently been holding officers back from enforcing laws, making arrests, or otherwise earning their paychecks.

The problem now is a lack of data, Comey claims. Law enforcement has lost control of the narrative, he stated, as if a one-sided portrayal of every police use of excessive/deadly force was somehow beneficial to the nation.

Dramatic videos of deadly law enforcement encounters and the absence of reliable data about how often police use force contribute to a regrettable narrative that "biased police are killing black men at epidemic rates," FBI Director James Comey said Sunday.

That story line has formed amid a lack of comprehensive, national data about how many citizens are killed or injured at the hands of police officers.

Thanks to the DOJ and FBI's active disinterest in collecting this data (until just recently), the "narrative" is no longer law enforcement's to control. Comey at least admits the FBI -- which was charged with collecting this data but somehow believed voluntary reporting would result in a comprehensive dataset -- is partly to blame.

We do not know whether number of black, brown or white people being shot by police is up because we have not collected data.

The problem with Comey's comments is that he apparently believes data on excessive force and killings by police officers will be ultimately exculpatory.

We need to show people what American law enforcement is really like, because if they see what we see, the chasm will close.

But the data collected by the public of its own initiative shows exactly what Comey claims it doesn't: that law enforcement officers are killing black men at "epidemic rates." Worse, Comey believes data collected and disseminated well after the fact will somehow be able to defuse immediate reactions to released video of officers killing or abusing citizens.

Videos of fatal police encounters that capture the public's attention and are shared broadly across the internet can fuel the perception that "something terrible is being done by the police," even if the data aren't there to back it up.

Given the audience, Comey probably didn't feel comfortable pitching the truth: that policing in America is every bit as bad as it's portrayed to be. Comey thinks data will give law enforcement control over the narrative, but that seems to be his only concern. The culture of American policing needs to change before the data start matching law enforcement's narrative.

Almost without fail, DOJ investigations of law enforcement agencies find two things: routine use of excessive force and biased policing. These aren't anomalies or "bad apples." This is how policing in America works.

As for the narrative, law enforcement still largely controls it. The corpse of the recently killed is barely on the way to the city morgue before law enforcement officials are dumping criminal records and officers' "feared for their safety" claims into the hands of reporters. No amount of pointing to stats is going to change the fact that far too many interactions are needlessly escalated by responding officers, or that biased police tactics are generating far too many interactions in the first place.

While it's good to know the FBI is finally going to push for better data collection on police use of force, the fact that it did nothing for nearly two decades counts against any goodwill it might hope to generate by finally doing its job. Unfortunately for those hoping this might lead to better policing, Jim Comey has made it clear it's really about controlling the narrative and pushing the American public to view law enforcement the way Comey feels they should be viewed: as good people in tough jobs who rarely, if ever, screw up. We'll just have to see what sort of spin is applied when Comey realizes the numbers aren't going to add up to his preconceptions.

Filed Under: data, fbi, james comey, law enforcement, police shootings

Senator John McCain Uses Cybersecurity Hearing To Try To Shame Twitter For Not Selling Data To The CIA

from the NO-ONE-CARES dept

John McCain -- fighting for the government's right to get all up in your everything -- has decided to embrace the "grumpy" part of his "grumpy old legislator" personality.

Back in July, McCain expressed his displeasure with Apple declining his invitation to show up and get yelled at/field false accusations at his hearing on encryption. He dourly noted that he was "seeking the widest variety of input," but his invited guests included Manhattan DA Cy Vance, a former Bush-era Homeland Security advisor and former NSA deputy director Chris Inglis. Not having Apple to kick around peeved McCain, who finished off the "discussion" with subpoena threats.

Another encryption hearing hosted by McCain devolved into the senator ranting about something no one cares about but him: a tech company not immediately prostrating itself in front of an intelligence agency. Here's Marcy Wheeler's summation of McCain's "contribution" to the discussion.

His tertiary point seems to have been to attack Apple and Twitter for making efforts to protect their customers. After getting a witness to comment about Twitter’s long-term refusal to let Dataminr to sell Twitter data to the CIA, he suggested perhaps the response should be to “expose” the company.

"Expose" how? This was "exposed" already, with the aftershocks of the exposure being "so what?" and "who cares?" Twitter simply enforced a pre-existing policy, pointing out to a third-party data mining company that it wasn't allowed to sell Twitter data to the government for surveillance use. This blocked the CIA from drinking from the Dataminr/Twitter firehose, which made the CIA sad and Twitter look stalwart and -- generally speaking -- didn't prevent the government from using any number of other methods to scoop up public tweets for surveillance purposes.

It also made McCain mad and he's still aching about it three months later. So, Wheeler has decided to help McCain out by publicizing Twitter's decision to hold a third-party social media data miner to the terms of its agreement with the government. Two more headlines have been added to her post, both breaking the news that was broken months ago and did little to appreciably nudge surveillance/outrage needles in any direction.

But it's still a big deal to McCain. He spent a little over two minutes (starting about 46:50 in the recording posted here) crafting his molehill into a mountain before cajoling NSA director Michael Rogers into answering what should have been a hypothetical question. While Admiral Rogers uncomfortably admitted he "didn't understand" why Twitter would enforce a pre-existing policy, McCain was unable to get anyone in the room to say anything on the record about "exposing" Twitter for its apparently nefarious decision to enforce the rules of Dataminr's agreement.

Wheeler has a better question:

Of course, you might ask why McCain is demanding that our tech companies to make money off of surveillance of you. And why he considers Twitter such an exception.

Filed Under: data, john mccain, surveillance
Companies: twitter

DOJ Finally Going To Force Law Enforcement Agencies To Hand Over Info On People Killed By Police Officers

from the better-late-than-never dept

At long last, the federal government is getting serious about tracking the use of deadly force by law enforcement officers.

For most of the last two decades, the DOJ has been collecting this information from local law enforcement agencies, but only on a voluntary basis. As a result, the federal numbers have nearly no relation to the real numbers -- which have been compiled by a handful of private actors, including The Guardian, a UK-based journalistic entity.

Last June, legislators introduced a bill (that promptly went nowhere) which would replace voluntary reporting with mandatory reporting. The FBI expressed its concern about the government's inability to collect accurate information on citizens killed by police officers, offering on multiple occasions to replace its voluntary system with a better voluntary system.

The Guardian is reporting that the voluntary system is finally being replaced with something that will create actual accountability.

Police departments will be required to give the US justice department full details of deadly incidents involving their officers each quarter, under a new government system for counting killings by police that was influenced by the Guardian.

Announcing a new program for documenting all “arrest-related deaths”, federal officials said they would actively work to confirm fatal cases seen in media reports and other open sources rather than wait for departments to report them voluntarily.

This still lets local PDs off the hook in terms of immediate self-reporting. But that's probably ok, as there's nothing in the reporting of deaths at the hands of police officers that encourages urgency or transparency from law enforcement agencies. With the feds independently verifying reported deaths -- i.e., those reported by journalists -- delays between reports and their addition to the federal numbers will be decreased dramatically.

Law enforcement agencies aren't completely off the hook, however. They'll still be required to report in custody deaths to the Justice Department. The difference is that the DOJ will no longer wait around for agencies to self-report. Local agencies heavily reliant on federal funding will probably be the agencies filling out these reports the fastest.

In their Federal Register article, officials cited their authority under the death in custody reporting act – a law that states local departments must report all deaths in custody to the justice department or lose 10% of their federal funding. The law has been largely ignored since being reauthorized in December 2014.

The other change of note is that this will no longer be a year-end tabulation after all the self-reporting is completed. Agencies can fill out one form for 2016's total deaths, but going forward will be required to hand these in quarterly.

Agencies will also be responsible for collecting a lot of data they've never had to previously. Details about the deadly incident will need to be provided, along with demographic data on the deceased. Coroners and medical examiners serving law enforcement agencies will also need to turn over information to the government and will be asked to confirm local news reports on officer-involved deaths.

This is a huge step forward for a federal agency that has long relied on voluntary reporting from compliant law enforcement agencies to tabulate the use of deadly force by officers. It's a sign that the federal government finally realizes the good people in law enforcement can't be relied on to hand over data on incidents that make them look less that perfect on a voluntary basis. Targeting federal funding is a smart move because that's the sort of money that gets spent on surveillance tools and 1033 acquisitions that agencies normally couldn't afford without it.

The real test will come when it's implemented, as it often takes more than federal mandates to alter entrenched cultures where accountability and transparency are considered weaknesses.

Filed Under: data, doj, information, police, shootings

Medical Researchers Want Up To Five Years Exclusivity For Clinical Trial Data Derived From Volunteers

from the papers-before-patients dept

A year ago, we wrote about how TPP's requirement for "data exclusivity" risked undermining one of science's fundamental principles: that facts cannot be owned. Data exclusivity is just the latest attempt by Big Pharma to extend its monopoly over drugs, whether using patents or other means. To a certain extent, you might expect that: after all, companies are designed to maximize profits, and if it means more people suffer or die along the way, well, that's regrettable but sort of beside the point. However, it's surprising to see a group of medical researchers writing in the prestigious New England Journal of Medicine (NEJM) calling for just the same kind of data exclusivity. The post is in response to an earlier NEJM article by the International Committee of Medical Journal Editors (ICMJE), entitled "Sharing Clinical Trial Data":

As a condition of consideration for publication of a clinical trial report in our member journals, the ICMJE proposes to require authors to share with others the deidentified individual-patient data (IPD) underlying the results presented in the article (including tables, figures, and appendices or supplementary material) no later than 6 months after publication.

Reasonable enough, you might think. But in the new commentary from the International Consortium of Investigators for Fairness in Trial Data Sharing -- which doesn't seem to have any online presence currently -- a group of "282 investigators in 33 countries" (pdf) beg to differ:

Although we believe there are potential benefits to sharing data (e.g., occasional new discoveries), we believe there are also risks (e.g., misleading or inaccurate analyses and analyses aimed at unfairly discrediting or undermining the original publication) and opportunity costs (e.g., the ICMJE proposal would have enormous direct costs and would probably divert resources, both financial and human, from the actual conduct of trials).

It's rather telling that the new discoveries that arise from research are dismissed as "occasional," while the rather weird concern about "discrediting or undermining the original publication" is put forward as if it were a major problem in the field. The International Consortium of Investigators for Fairness in Trial Data Sharing has a few suggestions for what should be done instead of the ICMJE proposal:

The timeline for providing deidentified individual patient data should allow a minimum of 2 years after the first publication of the results and an additional 6 months for every year required to complete the study, up to a maximum of 5 years.

Five years' data exclusivity takes us into TPP territory. And then there's this:

Persons who were not involved in an investigator-initiated trial but want access to the data should financially compensate the original investigators for their efforts and investments in the trial and the costs of making the data available.

You may have thought research was about winning new knowledge and willingly sharing it with your peers, but in fact it's about money. Actually, what is most shocking about the International Consortium of Investigators for Fairness in Trial Data Sharing's opinion piece is not what it says, but what it doesn't say. The whole thrust of the piece is what a tough life researchers have:

To complete an RCT [randomized, controlled trial], investigators must develop a protocol, obtain funding, overcome regulatory and bureaucratic challenges, recruit and follow participants, undertake analyses, and publish the results. This process takes several years, and for large clinical trials it can sometimes take a decade or longer. Adequate incentives for researchers to invest the substantial time and effort required to conduct RCTs and to publish the results in a timely fashion are important.

But at least it's a noble struggle, you might think, since this is all done for the patients' benefit. Or maybe not:

A key motivation for investigators to conduct RCTs is the ability to publish not only the primary trial report, but also major secondary articles based on the trial data.

It's all about those career-enhancing publications, apparently. But it's not just the patients who are missing from the International Consortium of Investigators for Fairness in Trial Data Sharing's worldview. They are also ignoring an absolutely indispensable aspect of clinical trials. It's so important that the ICMJE's article begins by acknowledging it in the first sentence:

The International Committee of Medical Journal Editors (ICMJE) believes that there is an ethical obligation to responsibly share data generated by interventional clinical trials because participants have put themselves at risk.

This is why the data that results from those clinical trials must be shared as soon as possible: because members of the public who volunteer to take part in them have literally risked their lives in order to benefit others. The idea that this data should be hoarded by the researchers for up to five years just so that they can squeeze out a few more articles that look good on their CV is profoundly insulting to the participants and their unsung selflessness.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: clinical trials, data, data exclusivity, medical research

Australian Government's Stupid Census Plans Puts Privacy At Risk, May Destroy Their Own Census

from the short-sighted-in-the-extreme dept

You may have heard that tomorrow is the official day for the Australian census to take place... and many people are planning to ignore it, because of massive security concerns and some incredibly stupid plans by the Aussie government to retain and make use of the data collected. Having an accurate population census is an extremely important tool for a wide range of government services, but especially in an age of increasing (and very legitimate) concerns about government overreach and surveillance, some are reasonably worried about what's done with the data. In the US, it's been made quite clear that census data absolutely must be kept secret and not connected to individuals or used for other purposes.

Over in Australia, they've apparently got some other ideas in mind. Late last year, the Australia Bureau of Statistics announced that for this year's census it would, for the first time, retain all the names and addresses it collected. This has raised some pretty serious concerns, and some fairly weak claims from the government. Prime Minister Malcolm Turnbull has announced that no one should worry because the government always protects people's privacy. No, really.

Mr Turnbull said on Wednesday the organisation "always protects people's privacy".

"The security of their personal details is absolute and that is protected by law and by practice," he said.

"That is a given."

Anyone claiming that the security of any system "is absolute" has no fucking clue about security. There is no such thing as absolute security, and saying as such probably just acts more to entice hackers to try to break in than anything else. The comments from the ABS's chief statistician are not any more comforting. When asked about security, he went with a Trumpian response of "we have the best security features."

"The ABS has the best security features," he said.

"We've never had a privacy breach with Census information and we do secure the information somewhat differently … These days we can keep names separate from address and separate from other Census content, in three separate computer systems and never brought together."

When asked if he believed this year's Census had been handled poorly, Mr Kalisch responded that "we're well ahead of where we thought we would be".

Making matters even worse, over the weekend, it was revealed that the ABS actually had plans to crossmatch people's data to other government services, and do other things with it -- which is exactly what a large part of the concerns were about.

“Retention of personal identifiers could improve the value of census data through data integration and linking, which would enable new products,’’ the document, released under freedom of information laws, stated.

The same document notes that there may be some "public backlash" to all of this "which would need to be carefully managed."

So far, they're not doing a very good job managing anything. The privacy and security concerns are growing rapidly, and people are speaking out on why they're willing to face fines and punishment by refusing to fill out the census -- even those who strongly support the idea of the census. This post from the former Deputy Privacy Commissioner, Anna Johnson, is well worth a read:

The definition of ‘census’ is “an official count”.  I actually want to stand up and be counted.  But only counted; not named or profiled or data-matched or data-linked, or anything else.  The privacy risks of doing anything else are just too great.

I have thought about just refusing to provide my name.  But even if I don’t give my name, if the ABS is determined to link my Census data with other datasets, there would be enough other information in my Census answers (sex, age, home address, previous home address, work address) to let them proceed regardless.  It won’t be enough to protect my privacy.

There's a lot more in Johnson's post that is worth reading, including just how ridiculous the privacy promises are, and even an analogy of how the ABS is acting "like a very, very bad boyfriend" who "keeps on breaking promises, pushing boundaries and disappointing you."

As for the security assurances, beyond just being ludicrous in claiming "absolute" security, there are already some pretty serious concerns. First of all, can you really claim that your security is "absolute" when you're storing passwords in plaintext? I don't think so -- but that's apparently what the ABS is doing with census passwords. Storing passwords in plaintext is the clear mark of an amateurish security operation.

On top of that, some are already finding that their older computers are apparently unable to handle the census. If the goal is to collect information on everyone, perhaps you should design a simple system that doesn't require a modern computer. Finally, shouldn't people be at least somewhat concerned when the security for the census is being handled by IBM, and an IBM "worldwide security architect" based in Australia tweets (and then deletes) that he expects the census data to be "inevitably leaked"? Having a census is important. But it should be clearly and directly limited to just that purpose. There should be no storage of names and addresses. There should only be storage of the final aggregate data. The fact that Australia is going in a different direction -- and considered "doing more" with the information, including crosslinking it to create "new products" should be extremely concerning. The fact that the government is claiming its security is "absolute" when it can't even properly handle passwords makes the whole thing a joke.

And, now, because of this mess, plenty of people say they're simply not going to obey and respond to the census. And while the Australian government may try to crack down on such behavior, in the end, it's absolutely going to call the accuracy of the census into question. So in their quest to expand the power of the census, the ABS may have done the exact opposite. * Special thanks to Australian journalist/privacy activist Asher Wolf for helping me go through some of the details on this story.

Filed Under: austaralia, census, crosslinking, data, privacy, security

[Updated] Wikileaks Leak Of Turkish Emails Reveals Private Details; Raises Ethical Questions; Or Not...

from the whoo-boy dept

Important Update: Michael Best has now come out and said that it was actually he who uploaded the files in question, which he got from the somewhat infamous (i.e., hacked the Hacking Team) hacker Phineas Fisher. Through a somewhat convoluted set of circumstances, it appeared the files were associated with the Wikileaks leak when they were not -- and then basically everyone just started calling each other names:

The files were obtained by Phineas Fisher, who was the source. As far as I can tell, Fisher did not intend to dump all of the files publicly, and Fisher has not indicated that he meant to give any of the files to WikiLeaks to publish. However, they received a partial set of the documents and decided to publish them.

Following the WikiLeaks release of the partial set, Fisher decided to release his set. Since the files came from a known source (Fisher has been responsible for many high profile hacks, including the hack on the Hacking Team), I used the torrent file that the files were released through to create a bittorrent instance on the Internet Archive’s server. The server proceeded to download the torrent and create the item that was linked to by WikiLeaks.

After the personal information was discovered, the AKP files were removed from the Internet Archive’s server.

Although I wasn’t aware that it was included in the release at the time, I accept my responsibility in distributing the personal information. The explanation as to how it happened is not an excuse for the fact that it did happen.

Of course, in the meantime, there's been a lot of nastiness, with Wikileaks and its supporters unfairly claiming that Zeynep Tufekci was an agent for the Erdogan government -- which is insane if you know her at all. As Best notes in his piece, it's entirely reasonable that Tufekci assumed Wikileaks was responsible for the files (even though she only accused them, accurately, of promoting the files, not uploading or hosting them -- and they did, in fact, tweet a link to the files as well as post it to Facebook), and while Wikileaks may be on the defensive about other claims about its leaks, it didn't need to attack her credibility in the process. And it is true that Wikileaks tweeted a link to the files.

Update 2: In response to our update, Zeynep Tufekci has sent over the following quote, noting that she still has concerns about how Wikileaks handled this:

"Wikileaks has never clarified that the emails it hosts are almost entirely mundane emails of ordinary citizens and revealed nothing of public interest after days of intense combing (though there were privacy violations there as well), and it has never apologized for the fact that the databases that it repeatedly, and via multiple channels, pointed to its millions of followers as full data of "our AKP emails" (they weren't) and "more" actually contained private and sensitive information of tens of millions of people in Turkey, including more than 20 million women. I never claimed that they hosted; I was agnostic on that point so none of the substantive discussions revolves around who hosted them. However, I'm glad the person who uploaded them has come forward to apologize, and learn from this. I hope the broader hacker community also reflects on this, and realizes that rushing, jumping on news cycles, dumping data indiscriminately, uploading stuff you do not know, working in a language you do not understand with no local contacts, and then accusing your critics of being government shills without the slightest attempt at research is not okay."

And... original article below.

Last week, we (like many others) reported on the news that Turkey was blocking access to Wikileaks, after the site released approximately 300,000 emails, supposedly from the Turkish government. We've long been defenders of Wikileaks as a media organization, and its right to publish various leaks that it gets. However, Zeynep Tufekci, who has long been a vocal critic of the Turkish government (and deeply engaged in issues involving the internet as a platform for speech) is noting that the leak wasn't quite what Wikileaks claimed it was -- and, in fact appears to have revealed a ton of private info on Turkish citizens.

Yes -- this "leak" actually contains spreadsheets of private, sensitive information of what appears to be every female voter in 79 out of 81 provinces in Turkey, including their home addresses and other private information, sometimes including their cellphone numbers. If these women are members of Erdogan's ruling Justice and Development Party (known as the AKP), the dumped files also contain their Turkish citizenship ID, which increases the risk to them as the ID is used in practicing a range of basic rights and accessing services. I've gone through the files myself. The Istanbul file alone contains more than a million women's private information, and there are 79 files, with most including information of many hundreds of thousands of women.

What's not in the leak, apparently, is anything really about Erdogan's government:

According to the collective searching capacity of long-term activists and journalists in Turkey, none of the "Erdogan emails" appear to be emails actually from Erdogan or his inner circle. Nobody seems to be able to find a smoking gun exposing people in positions of power and responsibility. This doesn't rule out something eventually emerging, but there have been several days of extensive searching.

At the very least, this does raise some ethical questions. In the past, Wikileaks has (contrary to what some believe!) actually been pretty good about redacting and hiding truly sensitive information that isn't particularly newsworthy. It's possible that this is just a slip up. Or it's possible that Wikileaks got lazy. Or it's possible that the organization doesn't care that much to go through what it gets in some cases. [Update: Or, see the update above, where we discover it was a third party that uploaded this data, that then got associated with the Wikileaks data after Wikileaks tweeted].

I still think that the organization has every right to release what it gets, but it should also be open to criticism and people raising ethics questions about what it has chosen to release. The fact that it appears to have failed to consider some of the questions in this case, and then possibly overplayed the story of what was in this release is certainly concerning, and harms Wikileaks' credibility. [Update: so, this was a mistake, though it's unfortunate that Wikileaks then lashed out out Tufekci and others making additionally baseless claims. Yes, it was wrongly accused, but that's no reason to wrongly accuse others as well.]

Filed Under: akp emails, data, emails, ethics, journalism, leaks, privacy, turkey, zeynep tufekci
Companies: wikileaks

Daily Deal: The Essential Data Analysis Bundle

from the good-deals-on-cool-stuff dept

Learn how to expertly crunch numbers for $39 with The Essential Data Analysis Bundle. Whether you're into finance, sports, IT or more, knowing how to make sense of large data sets can help you understand what is happening. You'll learn about statistics and their importance in helping you see the signals through the noise, how to present data to clients and stakeholders in clear and concise terms, and how to use all of the tools that Microsoft Excel has to offer to help you power through large data sets. With over 57 hours of instruction and hands-on tutorials, you'll be well on your way to becoming a data analysis expert.

Note: The Techdirt Deals Store is powered and curated by StackCommerce. A portion of all sales from Techdirt Deals helps support Techdirt. The products featured do not reflect endorsements by our editorial team.

Filed Under: daily deal, data, statistics

Consumer Groups Say AT&T, Comcast Violate Privacy Law By Hoovering Up Cable Box Data Without Full User Consent

from the informed,-empowered-consumers-cost-us-revenue dept

In addition to the $21 billion made annually by cable set top box rental fees, cable companies make untold billions from monetizing the user viewing data these boxes help collect. That captive revenue alone is the driving force behind the pay TV sectors histrionic opposition to the FCC's plan to open the sector up to third-party hardware competition. Consumer viewing and behavioral data is an immense cash cow, one the cable industry has occasionally threatened to take even further -- with patents on tech that lets the cable box literally watch or listen in on American living rooms.

While things haven't quite reached that level of total information awareness yet, consumer groups this week filed a formal complaint with both the FTC and FCC arguing that things have gone far enough. Public Knowledge, the Center for Digital Democracy and Consumer Watchdog have filed formal privacy complaints with both the FCC and FTC saying that major cable companies routinely fail to inform consumers about the degree in which their viewing data is collected, stored and monetized via ye olde cable box.

The complaints note that while most cable company privacy policies do alert consumers that they use personally identifiable information and third-party data for ads, these warnings don't go far enough to formally adhere to cable privacy rules on set-top box information:

"Federal law requires cable and satellite providers to obtain permission from subscribers prior to collecting and using their information for advertising purposes. Cable operators are also required to provide subscribers with a written statement that clearly describes the nature of the use of their personally identifiable information. Currently, cable operators obtain opt-out consent from consumers to use their information, which is insufficient to constitute prior consent under the law. And their privacy policies often fail to adequately disclose the extent to which they are sharing and combining customer data with third parties."

The complaints specifically single out Comcast, AT&T and Cablevision as "among the most egregious" when it comes to using consumer data without adequate consent. The complaint filed with the FCC (pdf) for example, notes that companies like AT&T often pull data from both the wireless and wireline empires to create mammoth databases of user behavior and personal information for targeted ads, without making the scope of this collection and usage clear to consumers or obtaining full, legal consent:

"AT&T’s TV Blueprint, for example, “gives advertisers working with AT&T the ability to reach people based on factors like device, operating system, whether or not they’re heavy data users or the status of their carrier contract,” using “sophisticated second-by-second set- top box data” and other information. AT&T pulls data “from millions of set-top boxes” and analyzes consumer viewing history and uses these data to target consumers based on their viewing profile. Companies like Cablevision leverage granular data and precise details of household viewing behavior, and combine it with third-party data covering other intimate details of consumers’ lives to analyze and target specific individuals with video advertising across a range of screens. In their own words, “this set-top box level targeting lets marketers target customers that fit particular trends, profiles, demographics and attributes, and they can also pair the Cablevision data with their own or third-party data."

With the FCC eyeing both set top box reform and new privacy rules for broadband providers, Public Knowledge is providing the commission with a little ammunition and fuel for thought on both fronts. Historically, consumer privacy in telecom and television has been feebly protected at best, and companies like AT&T have consistently pushed the barriers in their ever-expanding quest for more marketing data, whether that's the use of modified wireless packets to track users around the Internet, or charging a steep premium to opt out of deep packet inspection and data collection.

In the not-so-competitive realm of telecom, this is about as close to "innovation" as many sector companies get.

Specifically, Public Knowledge makes it clear they'd like to see such collection be made opt in instead of opt out, and argues that opting out doesn't go far enough to count as "consent" under existing privacy law:

"...The Commission should take the affirmative step of declaring that the use of customer information requires opt-in consent and that absent such consent, cable providers violate privacy rules by collecting customer information and using it to deliver marketing tailored to those customers."

As we've seen with the do not track debate, opting in is the bane of any data hoovering operation, given an informed and empowered consumer protected by a still-clawed regulator results in an obvious dent in the profit party. As such, telecom regulators have never been keen on supporting opt in, and it doesn't seem likely they'll start doing so anytime soon, despite the groups' request.

Meanwhile, AT&T was quick to unsurprisingly pooh pooh the groups' complaint as "bogus," while somehow arguing the attempt to protect consumer privacy would violate consumer privacy:

"AT&T’s use of anonymous and aggregate set-top box information is entirely consistent with the statute. Our disclosures tell our customers exactly how we use that data and provide tools for customers to opt out. Frankly, this complaint is bogus, and seems mainly designed to distract the public from the overwhelming bipartisan opposition to the FCC’s controversial set-top box plan.

That plan itself will erode existing consumer privacy protections, not to mention its many other harms. Because the plan’s few remaining supporters have no answer to that charge, they’ve decided to invent a false privacy claim. This smacks of desperation, and it also carries the whiff of hypocrisy. It’s further proof, if any is needed, that the plan’s supporters have lost the public policy debate on this issue."

AT&T somehow forgets to mention that most of the opposition to the FCC's set top box competition plan is entirely artificial -- generated in large part by AT&T and Comcast lobbying departments -- who've been busy filling editorial pages nationwide with absurd and misleading arguments.

The genuine reason for AT&T's opposition isn't surprising or complicated: ill-informed customers in un-competitive markets trapped in walled gardens are hugely profitable. Any deviation from this standard is treated as an egregious affront. But cable ops can't just come out and admit this is simply about protecting set top box monopoly money; that's why they've created groups like the "Future of TV Coalition" to try and complain -- like AT&T briefly does above -- that actually protecting cable customer privacy -- will somehow be a privacy violation in and of itself:

"But the new AllVid-style TV regulations being proposed by the FCC this week are an assault on consumer privacy. They will strip viewers of vital safeguards for their viewing choices and add “what we watch” to the mountains of data being mined and exploited by privacy scofflaws like Google, alongside their existing files of what we search for on the Internet; what we say in our gmail at home, work, and school; what happens in our “Nest”-connected homes; and where we go using Waze and Google Maps."

Cable companies could embrace opt in as a new standard and creatively offer small discounts to users who participate, but it's much easier to whine nebulously about Google. Companies like AT&T and Comcast desperately want to be regulated exactly like "edge providers" such as Google when it comes to privacy, ignoring the fact that their stranglehold over the broadband last mile -- and the cable box -- create a scenario whereby if regulators don't make at least a token effort to protect consumer privacy, the sky will be the limit in terms of abusing these captive markets and consumer walled gardens.

Filed Under: data, fcc, ftc, privacy, set top boxes
Companies: at&t, comcast, public knowledge

Oil Industry Group Claims Copyright On Oil Pricing Data, Gets Twitter To Delete Tweets

from the not-how-it's-supposed-to-work dept

The American Petroleum Institute (API), a group that represents the oil industry, apparently releases a fee-based report on oil prices, which is released to paying subscribers a week before the US government releases "official" data. For obvious reasons, this information is fairly valuable to traders, who are more than willing to pay the monthly fee to get early access to some crucial information on the price of oil. Apparently, last week, some people then took that data, and tweeted about it... leading API to issue DMCA takedown notices, which Twitter promptly complied with.

On Tuesday, several accounts posted the API data shortly after it was released to subscribers at 4.30 p.m. EDT. The posts were widely shared across the social network. Prices extended their losses shortly after the report, which showed a larger-than-expected increase in weekly inventories.

An account named @Cornice_Trading posted the data along with a message saying, "I don't have a sub, whatchugonnado API?!?" Through Wednesday afternoon, it had been retweeted five times and had received six likes.

[....]

The accounts named by API in its complaint to Twitter include oil traders and the popular financial commentary account @zerohedge, which has more than 300,000 followers. Two tweets by @zerohedge have been removed by Twitter in recent weeks. Zerohedge, which also runs a popular website, received notices from both the social network and from API, according to a spokesman for the website.

The article notes that, in the DMCA takedown letter sent by API, the group's lawyers claimed: "The posted excerpts contain the most important content of the WSB and is the heart of the work that API has created." This is, quite clearly, an attempt to pre-empt any fair use claim. Claiming that "the heart of the work" was included is based on the infamous Harper & Row v. Nation Enterprises case about publishing excerpts of former President Gerald Ford's memoir.

But that's meaningless if it's true that the information published was just factual data about oil prices. The Supreme Court decision in Feist v. Rural Telephone makes it clear that purely factual data gets no copyright protection at all. So if the data that is "at the heart" of what API released is nothing more than aggregated factual data, then it could not be deemed to have the minimum amount of "original creativity" included, and thus is not covered by copyright.

Even beyond that, if the information was covered by copyright, there still seems to be a strong fair use argument as well. But either way, Twitter simply decided to take those tweets down. The company claimed that it "has" to do that when it receives a valid DMCA notice, but that's not true. This is a constant misrepresentation of the DMCA. It just says that to retain the safe harbors, that say you're not liable, you need to take the content down. And, yes, while many risk averse lawyers will insist those two things are the same, because no company wants to give up its safe harbors, many companies can and do reject such bogus DMCA notices, recognizing that if the notices are bogus and the content is not infringing, then they'll be safe whether or not they have the safe harbors.

Filed Under: data, dmca, facts, oil data, takedowns
Companies: american petroleum institute, twitter

Administration Grants FBI More Raw Access To NSA Data Just As FBI Claims To Be Implementing New Minimization Procedures

from the offsetting-fouls? dept

Spencer Ackerman of the Guardian was the first to report the news -- what there was of it -- that the FBI's rules governing its access to data collected by the NSA have changed. To what exactly, no one knows. Neither agency is offering any details.

The classified revisions were accepted by the secret US court that governs surveillance, during its annual recertification of the agencies’ broad surveillance powers. The new rules affect a set of powers colloquially known as Section 702, the portion of the law that authorizes the NSA’s sweeping “Prism” program to collect internet data. Section 702 falls under the Foreign Intelligence Surveillance Act (Fisa), and is a provision set to expire in 2017.

A government civil liberties watchdog, the Privacy and Civil Liberties Oversight Group (PCLOB), alluded to the change in its recent overview of ongoing surveillance practices.

As of 2014, there were few limits to the FBI's access to NSA data. The PCLOB expressed its concerns at that time. Apparently, things have improved, but no one's willing to detail the additional restrictions. We're just expected to believe they're in place.

[T]he PCLOB’s new compliance report, released last month, found that the administration has submitted “revised FBI minimization procedures” that address at least some of the group’s concerns about “many” FBI agents who use NSA-gathered data.

“Changes have been implemented based on PCLOB recommendations, but we cannot comment further due to classification,” said Christopher Allen, a spokesman for the FBI.

Other spokespeople had similar nods of "yes, more restrictions" to add and even hinted that these new limits may be made public at some point. Heartening news… perhaps. We don't know how expansive the data-sharing was prior to the new guidelines and we still don't know how scaled back it will be post-restrictions.

For that matter, it seems as though the new limits will be largely offset by the administration's earlier announcement that the FBI would have more access to NSA data.

The Obama administration is on the verge of permitting the National Security Agency to share more of the private communications it intercepts with other American intelligence agencies without first applying any privacy protections to them, according to officials familiar with the deliberations.

The change would relax longstanding restrictions on access to the contents of the phone calls and email the security agency vacuums up around the world, including bulk collection of satellite transmissions, communications between foreigners as they cross network switches in the United States, and messages acquired overseas or provided by allies.

So, on one hand, the FBI is claiming that its backdoor search permissions have been dialed back, but that comes roughly two weeks after the administration announced its plans for expanded data sharing. What's being scooped up under national security authority is being used for plain vanilla law enforcement. Not only can the FBI access the NSA's collections (and it has been... for several years now), but it can pass info it finds down the line to local law enforcement agencies. Any minimization procedures put in place by the FBI at the suggestion of the PCLOB may still be there, but the agency itself will be given unminimized access to NSA data hauls.

What does this rule change mean for you? In short, domestic law enforcement officials now have access to huge troves of American communications, obtained without warrants, that they can use to put people in cages. FBI agents don’t need to have any “national security” related reason to plug your name, email address, phone number, or other “selector” into the NSA’s gargantuan data trove. They can simply poke around in your private information in the course of totally routine investigations. And if they find something that suggests, say, involvement in illegal drug activity, they can send that information to local or state police. That means information the NSA collects for purposes of so-called “national security” will be used by police to lock up ordinary Americans for routine crimes. And we don’t have to guess who’s going to suffer this unconstitutional indignity the most brutally. It’ll be Black, Brown, poor, immigrant, Muslim, and dissident Americans: the same people who are always targeted by law enforcement for extra “special” attention.

The rule change will basically codify the FBI's backdoor searches, making it that much tougher to challenge in court. Not only that, but the NSA's overwatch of the data lends everything collected just enough "national security" interest to make evidence collected unavailable to defendants and will encourage even more parallel construction by law enforcement agencies.

The "incidental" collection of Americans' communications and data will no longer be just a regrettable part of the "collect it all" approach. It will be a feature, rather than a bug. Local law enforcement agencies can't do much to pursue overseas suspects but they will be very interested in anything pulled from NSA haystacks that falls into their jurisdictions. If the FBI has actually beefed up its minimization policies -- as the Guardian's article suggests -- then it will have nothing to pass along. The agency may actually have more restrictive policies now, but the administration's proposal would effectively give the FBI a reason to ignore them.

Furthermore, the new expansion of sharing actually does very little to expand domestic law enforcement use of NSA collections. The FBI has been able to do this since 2002, when the FISA Court granted the Bush administration its request for expanded sharing. The Bush team expanded this again in 2008 and the Obama administration has been at work on the logistical framework and codification of ongoing domestic surveillance.

The FBI may have new minimization procedures but they only kick in after it's already helped itself to the NSA's raw data. Since it has the permission to pass information along for law enforcement purposes, the only entities that may see only minimized data will be much further down the line.

Filed Under: data, minimization, nsa, surveillance, white house